@

IAEA Nuclear Security Series No. 32-T

Technical GuidanceReference Manual

Establishing a System for Control of Nuclear Material

for Nuclear Security Purposes at a Facility during Use, Storage and Movement

IAEA NUCLEAR SECURITY SERIES

Nuclear security issues relating to the prevention and detection of, and response to, criminal or intentional unauthorized acts involving, or directed at, nuclear material, other radioactive material, associated facilities or associated activities are addressed in the IAEA Nuclear Security Series. These publications are consistent with, and complement, international nuclear security instruments, such as the Convention on the Physical Protection of Nuclear Material and its Amendment, the International Convention for the Suppression of Acts of Nuclear Terrorism, United Nations Security Council resolutions 1373 and 1540, and the Code of Conduct on the Safety and Security of Radioactive Sources.

CATEGORIES IN THE IAEA NUCLEAR SECURITY SERIESPublications in the IAEA Nuclear Security Series are issued in the following categories:

● Nuclear Security Fundamentals specify the objective of a State’s nuclear security regime and the essential elements of such a regime. They provide the basis for the Nuclear Security Recommendations.

● Nuclear Security Recommendations set out measures that States should take to achieve and maintain an effective national nuclear security regime consistent with the Nuclear Security Fundamentals.

● Implementing Guides provide guidance on the means by which States could implement the measures set out in the Nuclear Security Recommendations. As such, they focus on how to meet the recommendations relating to broad areas of nuclear security.

● Technical Guidance provides guidance on specific technical subjects to supplement the guidance set out in the Implementing Guides. They focus on details of how to implement the necessary measures.

DRAFTING AND REVIEWThe preparation and review of Nuclear Security Series publications involves the IAEA

Secretariat, experts from Member States (who assist the Secretariat in drafting the publications) and the Nuclear Security Guidance Committee (NSGC), which reviews and approves draft publications. Where appropriate, open-ended technical meetings are also held during drafting to provide an opportunity for specialists from Member States and relevant international organizations to review and discuss the draft text. In addition, to ensure a high level of international review and consensus, the Secretariat submits the draft texts to all Member States for a period of 120 days for formal review.

For each publication, the Secretariat prepares the following, which the NSGC approves at successive stages in the preparation and review process:

● An outline and work plan describing the intended new or revised publication, its intended purpose, scope and content;

● A draft publication for submission to Member States for comment during the 120 day consultation period;

● A final draft publication taking account of Member States’ comments.The process for drafting and reviewing publications in the IAEA Nuclear Security

Series takes account of confidentiality considerations and recognizes that nuclear security is inseparably linked with general and specific national security concerns.

An underlying consideration is that related IAEA safety standards and safeguards activities should be taken into account in the technical content of the publications. In particular, Nuclear Security Series publications addressing areas in which there are interfaces with safety — known as interface documents — are reviewed at each of the stages set out above by relevant Safety Standards Committees as well as by the NSGC.

ESTABLISHING A SYSTEM FOR CONTROL OF NUCLEAR MATERIAL

FOR NUCLEAR SECURITY PURPOSES AT A FACILITY DURING USE, STORAGE AND MOVEMENT

AFGHANISTANALBANIAALGERIAANGOLAANTIGUA AND BARBUDAARGENTINAARMENIAAUSTRALIAAUSTRIAAZERBAIJANBAHAMASBAHRAINBANGLADESHBARBADOSBELARUSBELGIUMBELIZEBENINBOLIVIA, PLURINATIONAL

STATE OFBOSNIA AND HERZEGOVINABOTSWANABRAZILBRUNEI DARUSSALAMBULGARIABURKINA FASOBURUNDICAMBODIACAMEROONCANADACENTRAL AFRICAN

REPUBLICCHADCHILECHINACOLOMBIACONGOCOSTA RICACÔTE D’IVOIRECROATIACUBACYPRUSCZECH REPUBLICDEMOCRATIC REPUBLIC

OF THE CONGODENMARKDJIBOUTIDOMINICADOMINICAN REPUBLICECUADOREGYPTEL SALVADORERITREAESTONIAESWATINIETHIOPIAFIJIFINLANDFRANCEGABONGEORGIA

GERMANYGHANAGREECEGRENADAGUATEMALAGUYANAHAITIHOLY SEEHONDURASHUNGARYICELANDINDIAINDONESIAIRAN, ISLAMIC REPUBLIC OF IRAQIRELANDISRAELITALYJAMAICAJAPANJORDANKAZAKHSTANKENYAKOREA, REPUBLIC OFKUWAITKYRGYZSTANLAO PEOPLE’S DEMOCRATIC

REPUBLICLATVIALEBANONLESOTHOLIBERIALIBYALIECHTENSTEINLITHUANIALUXEMBOURGMADAGASCARMALAWIMALAYSIAMALIMALTAMARSHALL ISLANDSMAURITANIAMAURITIUSMEXICOMONACOMONGOLIAMONTENEGROMOROCCOMOZAMBIQUEMYANMARNAMIBIANEPALNETHERLANDSNEW ZEALANDNICARAGUANIGERNIGERIANORWAYOMANPAKISTAN

PALAUPANAMAPAPUA NEW GUINEAPARAGUAYPERUPHILIPPINESPOLANDPORTUGALQATARREPUBLIC OF MOLDOVAROMANIARUSSIAN FEDERATIONRWANDASAINT VINCENT AND

THE GRENADINESSAN MARINOSAUDI ARABIASENEGALSERBIASEYCHELLESSIERRA LEONESINGAPORESLOVAKIASLOVENIASOUTH AFRICASPAINSRI LANKASUDANSWEDENSWITZERLANDSYRIAN ARAB REPUBLICTAJIKISTANTHAILANDTHE FORMER YUGOSLAV

REPUBLIC OF MACEDONIATOGOTRINIDAD AND TOBAGOTUNISIATURKEYTURKMENISTANUGANDAUKRAINEUNITED ARAB EMIRATESUNITED KINGDOM OF

GREAT BRITAIN AND NORTHERN IRELAND

UNITED REPUBLICOF TANZANIA

UNITED STATES OF AMERICAURUGUAYUZBEKISTANVANUATUVENEZUELA, BOLIVARIAN

REPUBLIC OF VIET NAMYEMENZAMBIAZIMBABWE

The following States are Members of the International Atomic Energy Agency:

The Agency’s Statute was approved on 23 October 1956 by the Conference on the Statute of the IAEA held at United Nations Headquarters, New York; it entered into force on 29 July 1957. The Headquarters of the Agency are situated in Vienna. Its principal objective is “to accelerate and enlarge the contribution of atomic energy to peace, health and prosperity throughout the world’’.

AFGHANISTANALBANIAALGERIAANGOLAANTIGUA AND BARBUDAARGENTINAARMENIAAUSTRALIAAUSTRIAAZERBAIJANBAHAMASBAHRAINBANGLADESHBARBADOSBELARUSBELGIUMBELIZEBENINBOLIVIA, PLURINATIONAL

STATE OFBOSNIA AND HERZEGOVINABOTSWANABRAZILBRUNEI DARUSSALAMBULGARIABURKINA FASOBURUNDICAMBODIACAMEROONCANADACENTRAL AFRICAN

REPUBLICCHADCHILECHINACOLOMBIACONGOCOSTA RICACÔTE D’IVOIRECROATIACUBACYPRUSCZECH REPUBLICDEMOCRATIC REPUBLIC

OF THE CONGODENMARKDJIBOUTIDOMINICADOMINICAN REPUBLICECUADOREGYPTEL SALVADORERITREAESTONIAESWATINIETHIOPIAFIJIFINLANDFRANCEGABONGEORGIA

GERMANYGHANAGREECEGRENADAGUATEMALAGUYANAHAITIHOLY SEEHONDURASHUNGARYICELANDINDIAINDONESIAIRAN, ISLAMIC REPUBLIC OF IRAQIRELANDISRAELITALYJAMAICAJAPANJORDANKAZAKHSTANKENYAKOREA, REPUBLIC OFKUWAITKYRGYZSTANLAO PEOPLE’S DEMOCRATIC

REPUBLICLATVIALEBANONLESOTHOLIBERIALIBYALIECHTENSTEINLITHUANIALUXEMBOURGMADAGASCARMALAWIMALAYSIAMALIMALTAMARSHALL ISLANDSMAURITANIAMAURITIUSMEXICOMONACOMONGOLIAMONTENEGROMOROCCOMOZAMBIQUEMYANMARNAMIBIANEPALNETHERLANDSNEW ZEALANDNICARAGUANIGERNIGERIANORWAYOMANPAKISTAN

PALAUPANAMAPAPUA NEW GUINEAPARAGUAYPERUPHILIPPINESPOLANDPORTUGALQATARREPUBLIC OF MOLDOVAROMANIARUSSIAN FEDERATIONRWANDASAINT VINCENT AND

THE GRENADINESSAN MARINOSAUDI ARABIASENEGALSERBIASEYCHELLESSIERRA LEONESINGAPORESLOVAKIASLOVENIASOUTH AFRICASPAINSRI LANKASUDANSWEDENSWITZERLANDSYRIAN ARAB REPUBLICTAJIKISTANTHAILANDTHE FORMER YUGOSLAV

REPUBLIC OF MACEDONIATOGOTRINIDAD AND TOBAGOTUNISIATURKEYTURKMENISTANUGANDAUKRAINEUNITED ARAB EMIRATESUNITED KINGDOM OF

GREAT BRITAIN AND NORTHERN IRELAND

UNITED REPUBLICOF TANZANIA

UNITED STATES OF AMERICAURUGUAYUZBEKISTANVANUATUVENEZUELA, BOLIVARIAN

REPUBLIC OF VIET NAMYEMENZAMBIAZIMBABWE

The following States are Members of the International Atomic Energy Agency:

The Agency’s Statute was approved on 23 October 1956 by the Conference on the Statute of the IAEA held at United Nations Headquarters, New York; it entered into force on 29 July 1957. The Headquarters of the Agency are situated in Vienna. Its principal objective is “to accelerate and enlarge the contribution of atomic energy to peace, health and prosperity throughout the world’’.

IAEA NUCLEAR SECURITY SERIES No. 32-T

ESTABLISHING A SYSTEM FOR CONTROL OF NUCLEAR MATERIAL

FOR NUCLEAR SECURITY PURPOSES AT A FACILITY DURING USE, STORAGE AND MOVEMENT

TECHNICAL GUIDANCE

INTERNATIONAL ATOMIC ENERGY AGENCYVIENNA, 2019

COPYRIGHT NOTICE

All IAEA scientific and technical publications are protected by the terms of the Universal Copyright Convention as adopted in 1952 (Berne) and as revised in 1972 (Paris). The copyright has since been extended by the World Intellectual Property Organization (Geneva) to include electronic and virtual intellectual property. Permission to use whole or parts of texts contained in IAEA publications in printed or electronic form must be obtained and is usually subject to royalty agreements. Proposals for non-commercial reproductions and translations are welcomed and considered on a case-by-case basis. Enquiries should be addressed to the IAEA Publishing Section at:

Marketing and Sales Unit, Publishing SectionInternational Atomic Energy AgencyVienna International CentrePO Box 1001400 Vienna, Austriafax: +43 1 26007 22529tel.: +43 1 2600 22417email: sales.publications@iaea.org www.iaea.org/books

© IAEA, 2019

Printed by the IAEA in AustriaJanuary 2019

STI/PUB/1786

IAEA Library Cataloguing in Publication Data

Names: International Atomic Energy Agency.Title: Establishing a system for control of nuclear material for nuclear security

purposes at a facility during use, storage and movement / International Atomic Energy Agency.

Description: Vienna : International Atomic Energy Agency, 2019. | Series: IAEA nuclear security series, ISSN 1816–9317 ; no. 32-T | Includes bibliographical references.

Identifiers: IAEAL 18-01200 | ISBN 978–92–0–103017–7 (paperback : alk. paper) Subjects: LCSH: Nuclear industry — Security measures. | Material accountability. |

Nuclear facilities. | Radioactive substances.Classification: UDC 341.67:620.267 | STI/PUB/1786

FOREWORD

by Yukiya Amano Director General

The IAEA’s principal objective under its Statute is “to accelerate and enlarge the contribution of atomic energy to peace, health and prosperity throughout the world.” Our work involves both preventing the spread of nuclear weapons and ensuring that nuclear technology is made available for peaceful purposes in areas such as health and agriculture. It is essential that all nuclear and other radioactive materials, and the facilities at which they are held, are managed in a safe manner and properly protected against criminal or intentional unauthorized acts.

Nuclear security is the responsibility of each individual State, but international cooperation is vital to support States in establishing and maintaining effective nuclear security regimes. The central role of the IAEA in facilitating such cooperation and providing assistance to States is well recognized. The IAEA’s role reflects its broad membership, its mandate, its unique expertise and its long experience of providing technical assistance and specialist, practical guidance to States.

Since 2006, the IAEA has issued Nuclear Security Series publications to help States to establish effective national nuclear security regimes. These publications complement international legal instruments on nuclear security, such as the Convention on the Physical Protection of Nuclear Material and its Amendment, the International Convention for the Suppression of Acts of Nuclear Terrorism, United Nations Security Council resolutions 1373 and 1540, and the Code of Conduct on the Safety and Security of Radioactive Sources.

Guidance is developed with the active involvement of experts from IAEA Member States, which ensures that it reflects a consensus on good practices in nuclear security. The IAEA Nuclear Security Guidance Committee, established in March 2012 and made up of Member States’ representatives, reviews and approves draft publications in the Nuclear Security Series as they are developed.

The IAEA will continue to work with its Member States to ensure that the benefits of peaceful nuclear technology are made available to improve the health, well-being and prosperity of people worldwide.

EDITORIAL NOTE

Guidance issued in the IAEA Nuclear Security Series is not binding on States, but States may use the guidance to assist them in meeting their obligations under international legal instruments and in discharging their responsibility for nuclear security within the State. Guidance expressed as ‘should’ statements is intended to present international good practices and to indicate an international consensus that it is necessary for States to take the measures recommended or equivalent alternative measures.

Security related terms are to be understood as defined in the publication in which they appear, or in the higher level guidance that the publication supports. Otherwise, words are used with their commonly understood meanings.

An appendix is considered to form an integral part of the publication. Material in an appendix has the same status as the body text. Annexes are used to provide practical examples or additional information or explanation. Annexes are not integral parts of the main text.

Although great care has been taken to maintain the accuracy of information contained in this publication, neither the IAEA nor its Member States assume any responsibility for consequences which may arise from its use.

The use of particular designations of countries or territories does not imply any judgement by the publisher, the IAEA, as to the legal status of such countries or territories, of their authorities and institutions or of the delimitation of their boundaries.

The mention of names of specific companies or products (whether or not indicated as registered) does not imply any intention to infringe proprietary rights, nor should it be construed as an endorsement or recommendation on the part of the IAEA.

CONTENTS

1. INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Background (1.1, 1.2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1Objective (1.3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1Scope (1.4–1.10). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1Structure (1.11) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

2. MANAGING NUCLEAR MATERIAL CONTROL (2.1–2.11) . . . . . 3

3. NUCLEAR MATERIAL CONTROL MEASURES (3.1–3.4). . . . . . . 6

Control of access (3.5–3.21). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Material containment (3.22–3.28) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Tamper indicating devices (TIDs) (3.29–3.41) . . . . . . . . . . . . . . . . . . 12Nuclear material surveillance (3.42–3.69) . . . . . . . . . . . . . . . . . . . . . . 16Monitoring nuclear material items (3.70–3.74) . . . . . . . . . . . . . . . . . . 23Monitoring nuclear material during processing (3.75–3.86) . . . . . . . . 24Physical inventory taking (3.87–3.89) . . . . . . . . . . . . . . . . . . . . . . . . . 26

4. MOVEMENT OF NUCLEAR MATERIAL (4.1–4.2). . . . . . . . . . . . . 28

Shipments of nuclear material (4.3–4.8) . . . . . . . . . . . . . . . . . . . . . . . 28Receipt of nuclear material (4.9–4.11) . . . . . . . . . . . . . . . . . . . . . . . . . 29Shipper–receiver difference evaluation (4.12–4.16) . . . . . . . . . . . . . . 30Transfers and relocations within a facility (4.17–4.25) . . . . . . . . . . . . 31

5. RESPONSE TO IRREGULARITIES IN NUCLEAR MATERIAL CONTROL (5.1–5.2). . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Investigation (5.3–5.20) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34Corrective actions (5.21–5.25) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38Reporting (5.26, 5.27). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

6. EVALUATION OF NUCLEAR MATERIAL CONTROL (6.1–6.7). . 40

7. INTERFACE WITH THE PHYSICAL PROTECTION SYSTEM (7.1–7.4). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

APPENDIX I: SELECTING A SAMPLE SIZE FOR ITEM MONITORING. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

APPENDIX II: STATISTICAL EVALUATION FOR MONITORING NUCLEAR MATERIAL IN PROCESSING . . . . . . . . . . . 44

APPENDIX III: MODEL FOR CALCULATING THE STANDARD ERROR OF A SHIPPER–RECEIVER DIFFERENCE . . . 45

REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

1

1. INTRODUCTION

BACKGROUND

1.1. The IAEA has developed general guidance on using a system of nuclear material accounting and control (NMAC) in support of nuclear security at the facility level [1]. A need has also been identified for more specific, detailed guidance on how to use individual elements of an NMAC system for nuclear security, including the control of nuclear material during its use, storage and movement.

1.2. The main purpose of nuclear material control measures is to maintain continuity of knowledge of the nuclear material for the purpose of detecting any actions that could lead to its unauthorized removal or misuse, particularly with respect to insiders [2]. Such measures may be applied during the production, processing, use, storage and movement of nuclear material, including activities designed to control access to the nuclear material itself, to the equipment used for processing the nuclear material and to information about the nuclear material. This publication addresses nuclear material control during production, processing, use, storage and movement in more detail than other IAEA Nuclear Security Series publications.

OBJECTIVE

1.3. The objective of this publication is to describe practical measures for controlling nuclear material for nuclear security purposes during all activities at a facility, including movements of material on-site.

SCOPE

1.4. For the purposes of this publication, nuclear material is defined as in IAEA Nuclear Security Series No. 20, Objective and Essential Elements of a State’s Nuclear Security Regime (the Nuclear Security Fundamentals) [3] and its Implementing Guide, IAEA Nuclear Security Series No. 30-G, Sustaining a Nuclear Security Regime [4].

1.5. This publication focuses on the control of nuclear material during production, processing, use, storage and on-site movement (i.e. shipment,

2

receipt, transfer and relocation) at a facility. Although nuclear material control should continue during off-site movement of nuclear material, this publication does not address specific control measures implemented for a shipment between facilities, which are covered in IAEA Nuclear Security Series No. 26-G, Security of Nuclear Material in Transport [5].

1.6. This publication does not indicate which organization is responsible for the control of nuclear material at a particular facility, as different States assign these responsibilities differently, in accordance with their national approaches.

1.7. Control of nuclear material comprises the administrative and technical measures applied to ensure that nuclear material is not misused or removed from its assigned location without approval and proper accounting [1]. This control may be applied for operational, NMAC or IAEA safeguards purposes [6], but this Technical Guidance addresses only the use of such measures for nuclear security purposes.

1.8. Accounting of nuclear material to meet requirements for reporting nuclear material inventories and transactions to the IAEA is addressed in other IAEA publications (e.g. the Nuclear Material Accounting Handbook [6]). However, accounting and control are strongly linked and should complement each other whenever possible.

1.9. Physical protection aspects [7] of access to a facility, an area or a room within a facility are outside the scope of this publication. This publication addresses control of access to locations where nuclear material is produced, processed, used or stored.

1.10. Response to and investigation of irregularities [1] resulting in an alarm generated by a control measure are briefly discussed in this publication but are not addressed in detail.

STRUCTURE

1.11. Section 2 provides guidance on managing nuclear material control. Section 3 contains descriptions of measures to be taken for nuclear material control. Section 4 presents details of the control of movements of nuclear material. Section 5 contains a description of measures to be taken in response to irregularities in nuclear material control, including investigation, corrective actions and reporting. Section 6 describes the process for evaluating nuclear material control at a nuclear

3

facility. Section 7 describes the interface with the physical protection system. Appendix I presents information on selecting a sample size for item monitoring. Appendix II provides an example of the statistical evaluation for monitoring nuclear material in a processing area. Appendix III presents an example of a basic model for calculating the standard error of a shipper–receiver difference.

2. MANAGING NUCLEAR MATERIAL CONTROL

2.1. Nuclear material control should be implemented in accordance with the policies and requirements of the State’s competent authority or facility operator and should take into account IAEA guidance [1]. Nuclear material control measures during use, storage and movement of nuclear material, including movements of waste containing nuclear material for disposal, should be addressed in documented procedures.

2.2. The facility operator should ensure that the roles and responsibilities of personnel involved in control and movement activities are clearly assigned. All personnel involved in activities involving nuclear material should be trained, to an appropriate level, in the procedures for control of nuclear material. The duties and responsibilities of nuclear material custodians1 should be clearly defined and documented. Duties should be separated between personnel — ideally personnel from separate parts of the operating organization within the facility (e.g. NMAC and operations) — to reduce the opportunity for a single individual to accomplish or hide unauthorized removal of nuclear material. A system of checks and balances should be in place to prevent a single individual from both handling nuclear material and updating the accounting records related to that material. This separation of duties serves as a measure to deter and detect insider threats.

2.3. A nuclear material custodian should not have responsibility for more than one material balance area. As stated in para. 4.12 of IAEA Nuclear Security Series No. 25-G, Use of Nuclear Material Accounting and Control for Nuclear Security Purposes at Facilities [1], a material balance area is:

“an area in a nuclear facility designated such that: (a) the quantity of nuclear material in each movement into or out of each [material balance

1 The term ‘nuclear material custodian’ refers to the individual (or individuals) assigned responsibility for nuclear material in a material balance area.

4

area] can be determined; and (b) the physical inventory of nuclear material in each [material balance area] can be determined when necessary, in accordance with specified procedures, in order that the material balance can be established. [Material balance areas] form the basis for NMAC for all nuclear material in the facility.”

It may be necessary to establish smaller material balance areas for nuclear security purposes within the material balance areas established for IAEA safeguards, because both accounting and control measures should be more stringent for locations or processes within those material balance areas containing larger quantities or more attractive materials.

2.4. Control of nuclear material should be implemented using a graded approach [7] based on the quantity and attractiveness of the material. For example, a Category I plutonium or high enriched uranium item not undergoing processing should be stored in a hardened room (‘strong room’) or hardened enclosure and be subject to additional controls, such as the two person rule [7], when the room is opened or closed, during operations inside the room and when the item is outside the room; in contrast, a quantity of low enriched uranium not undergoing processing may have less stringent controls applied for its protection. Application of a graded approach should be considered when implementing each nuclear material control measure mentioned in this publication.

2.5. Operations involving nuclear material should be authorized and planned appropriately. Control of nuclear material should be coordinated among all the organizational units at the facility that are involved with nuclear material production, processing, use, storage or movement. There should be clear communication and sharing of information, on a ‘need to know’ basis, among management and NMAC, physical protection, safeguards, safety and operations personnel regarding operations involving nuclear material, subject to protecting the confidentiality of sensitive information [8].

2.6. A schedule of planned activities involving nuclear material should be developed and maintained for all areas where nuclear material is stored or processed, including a list of all personnel requiring access to the areas. A written plan should describe all planned activities and how they will be carried out, including all nuclear material movements, physical inventory taking and regulatory inspections. All activities involving nuclear material at a facility, and their results, should be documented, including times, names of personnel involved, a description of the work performed and notes regarding any unusual events.

5

2.7. Activities involving nuclear material should be approved by the facility operator. A formal facility procedure should be developed and maintained to document the decision making process for management approval of activities involving nuclear material. If approval is required for use of equipment, this should be obtained in advance of the work. The facility operator should develop procedures for controlling the entry or removal of any objects or material, radioactive or non-radioactive, as appropriate.

2.8. Effective management of nuclear material control measures should include configuration management. As noted in para. 4.27 of Ref. [1]:

“The purpose of configuration management is to ensure that any change to any part of the NMAC system or any other relevant facility system will not degrade the performance of the NMAC system or overall nuclear security.”

Proposed changes should be described, assessed and submitted for approval by management, and approved changes should be issued, implemented and incorporated into the facility documentation. The facility operator should control all changes and ensure that they are reported, where required, to the appropriate authority.

2.9. An example of the need for configuration management is the installation of X ray equipment in an access control building. If the new equipment is installed in an area near radiation portal monitors, the radiation from the equipment could cause the portal monitors to generate an unnecessary alarm, creating what appears to be an irregularity. Careful consideration should be given to where to locate equipment that may interfere with equipment designed to control nuclear material.

2.10. Maintenance of nuclear material control equipment should be coordinated and scheduled at the facility level to ensure that the designed defence in depth is not compromised. For example, conducting maintenance of portal monitoring equipment at the same time as maintenance is being performed on video surveillance equipment in the area could create a vulnerability in the nuclear material control measures.

2.11. A facility’s training programme should include assessment of personnel’s knowledge of their role in activities involving nuclear material and verification that personnel are well informed about procedures for their specific activity. Additional guidance is provided in IAEA Nuclear Security Series No. 7, Nuclear Security Culture [9].

6

3. NUCLEAR MATERIAL CONTROL MEASURES

3.1. Nuclear material control measures include, but are not limited to, control of access, material containment, tamper indicating devices (TIDs), nuclear material surveillance, monitoring of nuclear material items, monitoring of nuclear material during processing, and physical inventory taking. Each of these measures addresses a specific need, in controlling nuclear material, to detect irregularities that might ultimately lead to or conceal unauthorized removal of nuclear material, and to deter and detect misuse or unauthorized removal by an insider. The number and nature of measures necessary to provide adequate control are dependent on several factors, notably: the threat identified by the State; the amount of nuclear material located at the facility; and the categorization of the nuclear material, as indicated in table 1 of IAEA Nuclear Security Series No. 13, Nuclear Security Recommendations on the Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 5) [7]. Appropriate points or locations at which nuclear material control measures are to be applied should be established, taking into account the locations of nuclear material within the facility and movements of nuclear material. The results of evaluations of the NMAC and physical protection systems should also be considered.

3.2. Nuclear material control measures should be designed to provide continuous control of nuclear material, and compensatory measures (see para. 3.67) should be used to prevent loss of control of nuclear material in the case of a single point failure of the NMAC system.

3.3. A system for control of nuclear material for nuclear security purposes at a facility should include measures for management of nuclear material control records. Records should be kept documenting the implementation of all nuclear material control measures. These records should include a brief description of each nuclear material control activity (the use of standard forms for documenting these is suggested), the signatures of the personnel performing the activities and the dates on which the activities were performed. Records should be securely maintained and should be readily available to those requiring access to them in the event an irregularity occurs or when an audit of the nuclear material control system is conducted.

3.4. The State’s competent authority (or the facility operator, as appropriate) should establish the rules for implementation of nuclear material control measures based on a graded approach.

7

CONTROL OF ACCESS

3.5. Control of access during routine, non-routine and actual or simulated emergency situations is important to effective nuclear security.

Control of access to nuclear material

3.6. The control of access to nuclear material and the locations where it is produced, processed, used or stored is important to the facility’s nuclear security programme and should be coordinated between the operations, NMAC, physical protection and safety departments.

Routine access

3.7. The facility operator should develop procedures for controlling access to its nuclear material, including: a description of the requirements for access to be approved; clear assignment of roles and responsibilities; and instructions to ensure the timely removal of access approval from personnel who may have been transferred to another area of work or whose employment at the facility has been terminated. The facility operator should have a programme for ensuring that the trustworthiness of its personnel [9] is commensurate with the quantity and attractiveness of the nuclear material at the facility. Furthermore, a facility operator’s training programme should include assessment of personnel’s knowledge of their role in activities involving nuclear material.

3.8. Approval by the appropriate person should be required for personnel to enter an area where nuclear material is located, and controls (e.g. the two person rule) should be implemented to prevent a single person from being able to open or enter an area containing a Category I quantity of nuclear material. This is also good practice for Category II storage areas.

3.9. A system to approve visitors and temporary workers having access to the facility while being escorted should be part of the routine access procedures. Information about such individuals will typically need to be provided in advance to prepare for the visit or planned work, and visitors and temporary workers should be required to present the appropriate documentation to prove their identity upon arrival at the facility. Training for awareness of safety and security requirements and working conditions in the facility should be required prior to access to the facility.

8

3.10. Persons authorized to escort visitors and temporary workers should have appropriate access approval, be knowledgeable about the areas to be visited, and be prepared to take appropriate actions in the case of an emergency. Records should be kept to identify all employees, visitors and temporary workers allowed to access the facility.

Non-routine access

3.11. Facility operators should develop procedures and conduct exercises to prepare personnel to conduct non-routine activities (e.g. unscheduled evacuations). Facility operators should ensure that contingency plans are developed and that mitigating measures are put in place if normal access controls are degraded or fail. For example, in the case of an unscheduled evacuation of an area containing nuclear material, procedures should be developed describing the process for monitoring personnel who exited the area without undergoing the usual checks. Compensatory measures, such as radiation monitoring of individuals, should be used to ensure that no unauthorized removal of nuclear material occurred.

Actual or simulated emergency situations

3.12. Procedures describing the control measures to be taken in an emergency situation should be developed and responsible personnel should be identified. When developing emergency plans and procedures for emergency situations [10, 11], facility operators should take into account the need for additional measures for control of nuclear material (e.g. control measures to be applied when emergency responders such as firefighters are given access to areas where nuclear materials are located). Facility personnel responsible for these control measures should be trained and qualified in applying them during an emergency.

3.13. The necessary actions, access needed and personnel involved in the emergency response need to be identified at the preparedness stage [10, 11]; adequate nuclear material control measures should then be put in place. Consideration should also be given to nuclear material control measures when preparing and conducting exercises.

Control of access to equipment or other devices used for activities involving nuclear material

3.14. Equipment used for all activities involving nuclear material, including handling, measuring, application of TIDs or processing (e.g. gloveboxes, empty

9

containers, sample vials, cranes), should be controlled, since it could potentially be used for unauthorized removal or misuse of nuclear material. The equipment that is to be subject to access control procedures should be determined based on the type of activities conducted with nuclear material. Procedures should set out the control measures required for the use of such equipment in activities involving nuclear material. Approval should be obtained from the appropriate part of the operating organization before the equipment is brought into or used in an area containing nuclear material. Different parts of the operating organization should share information and communicate with one another regarding the presence and use of nuclear material and equipment in nuclear material areas, and the times when they anticipate that their personnel will be in nuclear material areas.

3.15. An example of control measures on access to equipment would be the combination of key control and application of TIDs to a crane used to move large equipment or containers of nuclear material in a processing area or spent fuel assemblies in a spent fuel pool. The measures would deter, delay and allow detection of any attempt at unauthorized removal of nuclear material using the crane.

3.16. Devices and information that provide access to locations containing nuclear material or equipment for moving or processing nuclear material, including keys and combinations for locks, should be controlled, including, as appropriate, tracking of key usage (e.g. by maintaining a log). If two keys or combinations are needed for access, no single individual should have access to both.

3.17. Other devices whose use or accessibility should be controlled include devices that could be used for removing containment devices (such as locks) applied to a location where nuclear material is stored. Similarly, devices that could be used to remove TIDs from containers of nuclear material should be controlled if they are allowed in an area where nuclear material is located.

Control of access to data related to nuclear material

3.18. A major challenge facing nuclear security programmes is the security of data, especially electronic data. Nuclear material records and reports, facility schematics, and details of access routes are sensitive information and should be secured. Guidance on information security is provided in IAEA Nuclear Security Series No. 23-G, Security of Nuclear Information [8]. An evaluation should be performed of the specific information security needs of the facility. For example, information about shipments and receipts might be especially sensitive and need to be protected accordingly. Physical and administrative measures to control

10

electronic and physical access to databases containing sensitive information should be commensurate with the consequences of the information in the database being compromised. Special consideration should be given to ensuring that sensitive information is not included in media that may be more widely or publicly disseminated (e.g. corporate newsletters, web sites).

3.19. Coordination among different parts of the organization, particularly those responsible for NMAC, computer security and physical protection, is critical to the effective security of the facility’s sensitive information.

3.20. Rules for approval and control of access to sensitive information, including electronic data systems, should be strictly enforced. These rules should be reviewed and updated regularly to achieve the required level of information security. Personnel should have access to information (on paper and digitally) on a ‘need to know’ basis and should be trained in how to use the systems for obtaining such information and handling it securely. Controls and data verification should be established to ensure that a single individual cannot manipulate the data to accomplish, or delay detection of, the unauthorized removal of nuclear material. Procedures should be developed and implemented to control all activities involving sensitive information and the systems on which it is stored and processed, and to provide reports documenting such activities. Such reports should include the identity of any person making entries, modifications or corrections to sensitive information or to the associated systems. These reports should be retained, as required, by the State’s competent authority.

3.21. Separation of duties is good practice. For example, when personnel in a processing area are packing nuclear material for shipment to another facility, they should not have the ability to input the data into the accounting system to show the nuclear material items being shipped without someone else (e.g. a person from another part of the organization) having final control or approval of the data entry. One way to control this is to require that an accounting person from the NMAC part of the organization be present during the packing process to review the data and confirm that the nuclear material items shown as having been packaged for shipment are actually the nuclear material items being shipped.

MATERIAL CONTAINMENT

3.22. The purpose of material containment is to ensure that nuclear material remains where it should be, allowing the facility operator to maintain continuity of knowledge of it, by preventing undetected access to, movement of, or interference

11

with nuclear or other radioactive material. Material containment is achieved through the structural features of a facility, containers and other equipment used to establish the physical integrity of an area or items. Containment may include fences, buildings, a storage room or storage pool, transport flasks, or storage containers. The types and levels of containment should be consistent with the quantity and attractiveness of the nuclear material.

3.23. The continuing integrity of the containment is usually assured by the use of TIDs or (especially for containment penetrations such as doors, vessel lids and water surfaces) surveillance measures, and by periodic examination of the containment. A breach of containment may indicate the unauthorized removal of nuclear material. The removal of nuclear material from a secure storage location (for processing, shipment or movement) should be controlled to prevent unauthorized removal. Secure temporary storage (e.g. cabinets, safes, cages with double locks or TIDs installed) should be used to maintain the continuity of knowledge of material that is maintained outside permanent storage while in preparation for processing.

3.24. Facility operators should employ a system of segregation and control to prevent the introduction of less attractive material to conceal the unauthorized removal of more attractive material, for example:

— Storing different categories of uranium (natural, depleted, low enriched, high enriched) in separate areas;

— Segregating waste from product material; — Controlling non-nuclear material that could be substituted for nuclear material (e.g. blank or dummy fuel assemblies).

3.25. Possible routes for unauthorized removal of nuclear material (e.g. emergency exits, waste disposal points, ventilation ducts, other penetration points) should be identified and controlled. For example, installation of fine metal mesh, in such a manner that its removal would be detected, in addition to grates on windows and ventilation ducts may prevent the unauthorized removal of nuclear material through these openings.

Design of containment measures

3.26. The design of containment measures should be appropriate for the type of facility to be protected. A facility at which nuclear material items are handled but nuclear material is not processed has different requirements than a facility at which bulk processing of nuclear material is carried out. Monitoring of nuclear

12

material during processing may need to be done differently depending on whether the material is in bulk or item form.

3.27. Facility features primarily designed for other purposes can also provide robust containment for materials. For example, the thick walls, ceilings and floors of facilities producing, processing, using or storing highly radioactive nuclear material, intended to provide adequate radiation protection, also can act as a containment measure for the materials held within. Highly radioactive material also calls for the use of specialized handling procedures, techniques and equipment to move the material into and out of the facility. These features present an obstacle to the removal of material and can contribute to nuclear material control.

3.28. The containment design process should take into account the needs of physical protection, NMAC and safety, and therefore should involve personnel with expertise in these areas.

TAMPER INDICATING DEVICES (TIDs)

3.29. As noted in para. 4.130 of Ref. [1]:

“The use of a [TID] with unique identification features provides a level of confidence that the item protected by the [TID] has not been opened. The objective of a [TID] is to ensure that no undetected tampering or entry occurred while it was on the item.”2

The use and selection of TIDs should be based on a graded approach.

Use of TIDs for nuclear material control

3.30. A TID by itself does not protect against the removal of nuclear material from a container or location. The TID preserves the continuity of knowledge of the material by indicating whether or not the container or location has been accessed. TIDs not only enable detection of unauthorized access, but can also deter an insider because the insider may perceive that the TID is an obstacle that decreases the chances of undetected access to the material. TIDs should be used in conjunction with effective material surveillance, as discussed in paras 3.42–3.69.

2 This publication does not address TIDs (seals) used by the IAEA for safeguards purposes.

13

3.31. During nuclear material movements, TIDs may be applied to nuclear material containers, shipping containers and the transport vehicle cargo compartment, to provide assurance for both the shipping and the receiving entity that the container and compartment integrity have not been violated. The TID integrity, the TID identity and the integrity of the containment should be examined to verify that the continuity of knowledge of the nuclear material has been maintained throughout the movement process.

3.32. At the facility, TIDs may be applied to objects providing containment for nuclear materials (e.g. containers, doors, safes) when the material is in storage or when immediate access to it is not needed. The use of TIDs may reduce the need for remeasurement for accounting purposes, the effort of physical inventory taking and the need for nuclear material item control and monitoring activities. A TID programme may also reduce the time needed for emergency or unscheduled inventories and aid in the investigation of irregularities. TIDs can also be used to prevent the unauthorized use of equipment.

Types and selection of TIDs

3.33. Several types of TID are commercially available, having a broad range of characteristics and capabilities, and using a variety of means to indicate tampering (e.g. cable locks; steel padlocks; electronic radio frequency tags; pressure sensitive (self-adhesive), type E cup wire, car/ball end (steel strap), fibre-optic and tamper-evident wire TIDs). Electronic TIDs provide continuous monitoring of signals and can provide near real-time alarms. As noted in Ref. [1], “Devices that can be easily copied (e.g. lead or wax seals) or defeated are not appropriate for use as tamper indicating devices in an NMAC system.”

3.34. The State’s competent authority may require that TIDs meet certain specifications and may require certification of specific TID types for use. TIDs should be appropriate for the intended use (e.g. ensuring the integrity of an item, a storage cabinet or a room) and should be capable of withstanding the actual conditions of use (e.g. temperature, moisture, repeated handling, radiation, chemicals) without any degradation that could allow tampering or be mistaken for evidence of tampering. The acceptability of a TID should be based on engineering studies that demonstrate its appropriateness for the conditions of use through an evaluation of the attributes of the device in relation to the time and means needed to defeat the tamper indicating features (e.g. evaluation of manufacturer data and field tests). A trained and knowledgeable person should be designated by the facility or the State’s competent authority to test and approve each type of TID for use on a case by case basis.

14

Limitations of TIDs

3.35. A TID would fail to perform its function if it could be replaced, removed and reapplied, or altered without leaving any indications of tampering. Because TIDs have limitations that may be exploited in such ways, facility operators should seek to prevent unauthorized persons from defeating the TID under the time and resource constraints imposed by the other security measures in place. For example, when a TID is used in an inner area, an adversary will be limited in terms of what tools or chemicals he or she can bring into the area and may have only a few minutes to defeat the TID before being interrupted.

Substitutions

3.36. A TID may be able to be removed and replaced with another TID of the same design. For this reason, all TIDs should bear a unique identifier (e.g. a facility specific logo and serial number). The manufacturer should ensure that the TIDs are unique; that the facility specific, uniquely identified TIDs are not supplied to other facilities; and that the prototype used to design the TIDs and their specifications are controlled. If an alphanumeric code sequence is used for unique identification, then the sequence should contain enough characters to allow it to remain unique for longer than the likely lifetime of the TID design. One or two characters may be added to identify the material balance area so that each TID custodian responsible for a given material balance area can use a unique set of TIDs. Facility operators should take steps to ensure that duplicate numbers are not used. To facilitate the recognition of serial numbers and reduce manual recording errors, it is good practice to use a bar coding system, preferably printed directly on the TID. This is possible for many types of TID, including pressure sensitive (self-adhesive) and cable type TIDs.

Removal and reapplication

3.37. Proper application of TIDs is essential to ensure correct functioning. When a TID is used to seal a container, the manner of application of the TID should ensure that the contents cannot be removed without compromising the integrity of the TID or the container. Clear installation instructions describing proper application and use of TIDs should only be available to relevant authorized personnel. Facility procedures for installing and verifying installed TIDs should take into account manufacturer specifications for conditions of use.

15

Alterations

3.38. The design and use of TIDs should make obvious any alterations to recorded data on the TID, including alterations to the unique identifier. If data need to be manually recorded on TIDs, the facility operator should ensure that this information cannot be erased or washed off intentionally or inadvertently without the alteration being readily apparent. With modern computerized systems, the serial identification number may be the only information recorded on the TID, although it is good practice to use a barcode and scanner to aid in identification. The computer system can use that number or barcode to correlate the container with separately recorded nuclear material item identification and measurement data.

3.39. Facility operators should not rely solely on a TID serial number for container identification, because removal or attempted removal of the TID may render the serial number unreadable, resulting in loss of access to information about the contents of the container. Container numbers that are separately marked on containers will help to identify the container and its contents if the TID is removed or destroyed. The container number or barcode and the TID serial number or barcode should be compared with the recorded information to ensure that the TID remains attached to the correct container.

3.40. Facility operators should maintain control over computerized or handwritten data associated with TIDs, to prevent or detect any attempt at unauthorized alteration of those data. For example, if a TID were defeated, material were removed from the container and NMAC records were altered to reflect the quantity left in the container, and neither the defeat of the TID nor the alteration of NMAC records were detected, the theft would be discovered only during verification measurements or as a result of the discovery of material unaccounted for (MUF) during the next physical inventory taking.

Elements of an effective TID programme

3.41. An effective TID programme at a facility should include controls on the acquisition, procurement and destruction of TIDs. In particular, facility operators should ensure that the following features and practices are part of the TID programme:

— The TIDs being used are capable of withstanding the conditions of use without degradation that could allow tampering or be mistaken for evidence of tampering.

16

— The TIDs being used bear a unique identifier (e.g. a facility specific logo and serial number).

— TIDs are applied in a manner that makes undetected removal difficult and that ensures that the contents cannot be removed from the sealed container without compromising the integrity of the TID or the container.

— Control measures are taken to protect the nuclear material in a container during the time between measurement of the material and application of the TID.

— Records tracking TID application, verification and removal are developed and maintained, including the date of use, the identity of the personnel who applied the TID, the identity of the container with the TID and the TID’s identification number.

— TIDs are only applied and removed by authorized individuals. — The two person rule is used when applying, verifying, removing and destroying TIDs.

— Unused TIDs are secured, as are TIDs that have been removed but not yet destroyed, and the inventory of unused TIDs is periodically verified.

— TIDs that have been removed are destroyed to ensure that they cannot be reapplied.

— Procedures are developed for facility personnel to follow when implementing all parts of the TID programme, including audits and inspections of the TID programme.

— Personnel working with TIDs are trained in all aspects of the programme, including the use, application, removal, destruction, storage, issuance and verification of TIDs.

NUCLEAR MATERIAL SURVEILLANCE

3.42. Material surveillance measures should be used to detect unauthorized access to or movement of nuclear material. This publication refers only to material surveillance measures implemented by the facility operator as part of its nuclear security programme.3

3.43. A graded approach based on the type, quantity, form and attractiveness of nuclear material should be considered when developing the nuclear material surveillance programme and selecting types of material surveillance measures.

3 Material surveillance performed for purposes of IAEA safeguards is not addressed in this publication.

17

Elements of an effective material surveillance programme

3.44. As noted in para. 4.136 of Ref. [1], a surveillance programme should ensure at least that:

“— Only authorized and knowledgeable personnel who are capable of detecting incorrect or unauthorized activities are assigned responsibility for surveillance of nuclear material.

— Equipment which could be tampered with to prevent detection of unauthorized removal of nuclear material or other unauthorized activities [by an insider] is monitored.

— When the two person rule is the surveillance method, the two authorized persons are physically located where they have an unobstructed view of each other [and] the nuclear material, and each person is trained and capable of detecting unauthorized activities or incorrect procedures.

— Weaknesses of individual components of surveillance and monitoring systems cannot be used by [an insider], e.g. shielding of radiation monitors, manipulation of [TIDs] and electronics, manipulation of nuclear material items or equipment which cannot be easily identified by surveillance.

— Nuclear material in use, process or storage [and movement] is under proper surveillance, alarm or equivalent protection.”

3.45. In addition, the following procedures and practices should be included in the surveillance programme, as appropriate for the facility:

— Adequate surveillance measures are in place to reduce the opportunity for a single individual to gain access to areas where the two person rule is in use.

— All personnel in areas that contain nuclear material are under appropriate surveillance (e.g. the two person rule) when the area is not locked and protected by an active alarm system.

— It is possible to detect the entrance of unauthorized or unaccompanied authorized personnel into the storage or processing area when the door is unlocked or open.

— Radioactive and non-radioactive waste disposal points are monitored to reduce the likelihood that they could be used as a pathway for unauthorized removal of nuclear material contained within the waste.

— Ventilation ducts, drains and other penetrations of the facility structure are monitored (e.g. using non-destructive assay equipment or a radiation monitor) to detect the unauthorized removal of nuclear material through any of these penetrations.

18

Use of material surveillance measures

3.46. Surveillance is particularly important during movement of nuclear material. Material surveillance measures should be designed and implemented to minimize the opportunity for nuclear material to be moved without approval from the appropriate personnel. For example, if an unapproved movement of nuclear material is detected, local audible alarms could be used to inform personnel who are near enough to respond. Facility personnel may be assigned to perform visual surveillance to minimize the opportunity for nuclear material to be accessed or moved without the appropriate approval. Equipment may also be used for surveillance. For example, the flow of enriched uranium solution between tanks may be monitored using a differential pressure manometer.

3.47. Surveillance of measurement equipment used in nuclear material processing and storage should be performed as needed. Material surveillance measures can be used to detect unauthorized use of this equipment by providing ongoing information about its status. For example, an insider who has authorized access to an area containing nuclear material may be able to tamper with measurement equipment so that the equipment provides misleading or incorrect information related to nuclear material. Such tampering could be used to conceal unauthorized removal.

3.48. The use of surveillance measures allows the evaluation of any indication of a breach of containment or unauthorized access to a limited access, protected, inner or vital area. Material surveillance measures should be considered in all areas used for production, processing, use or storage of nuclear material and should complement the containment measures.

3.49. Material surveillance measures may also be used outside these areas. Surveillance measures should be applied to equipment such as gloveboxes and to areas where activities related to nuclear material are performed, such as the shipment or receipt of nuclear material. Both radioactive and non-radioactive waste streams should be monitored to ensure that unauthorized removal of nuclear material is not occurring via the waste streams.

3.50. Both administrative and technical measures may be used for material surveillance, as described in more detail in paras 3.52 and 3.53. These measures should be implemented in combination with other measures, such as authorization and control of access, to provide defence in depth. The surveillance measures selected should be appropriate for the conditions of use (e.g. motion detectors may not be effective in a busy processing area during operating hours).

19

3.51. Material surveillance personnel may benefit from monitoring activities performed for other purposes by personnel in other parts of the organization. Arrangements should be made for personnel performing other monitoring activities to promptly notify the NMAC and physical protection personnel of any indication of possible unauthorized removal of nuclear material.

Administrative measures for material surveillance

3.52. Administrative measures for material surveillance should be used to control access to nuclear material to those personnel approved by the facility operator and to maintain continuous surveillance over nuclear material during processing or whenever the material is outside locked and alarmed storage. Administrative controls should include a list of authorized personnel permitted to enter the storage or processing area. For example, a Category I storage area should only be entered by two personnel together, both of whom are on the list of authorized personnel (i.e. the two person rule). This is also good practice for Category II storage areas. For a Category III processing area, measures should ensure that only authorized personnel are permitted to enter the area and that their activities within the area are under surveillance.

3.53. Administrative measures can be supplemented or supported by technical measures for material surveillance. For example, if the two person rule (an administrative measure) is used within a storage area, the doors to the storage area may be locked with devices that require two authorized personnel to open them (a technical measure) to prevent a single individual from entering the storage area alone.

Technical measures for material surveillance

3.54. Technical measures for material surveillance include equipment used to observe and monitor nuclear material and its associated equipment. The technical measures used should be capable of providing real-time or near real-time alarms to indicate both the failure of the surveillance measures themselves as well as the failure of the material control measures under surveillance. Examples of technical measures include video surveillance, weight sensors, radiation portal monitors and other radiation monitoring equipment, X ray equipment and metal detectors, and TIDs with radio transmitters.

20

Video surveillance

3.55. To be capable of providing timely alarms, effective video surveillance should include:

— An independent power supply that provides the capability to keep the equipment operational in the case of an electrical outage;

— A system for recording and archiving data for later review and analysis, if needed;

— A method to protect against video and data falsification; — A method to analyse video data so that an alarm may be activated as needed, for example, to indicate if a movement or sequence of movements is abnormal for an activity or if an activity is being attempted outside normal working hours.

3.56. When considering the use of video surveillance, the location of cameras, the central video data server and monitoring stations should be evaluated to ensure the security and effectiveness of surveillance. Access to cameras and data should be controlled.

Weight sensors

3.57. Weight sensors may be used to monitor containers of nuclear material. For example, a system of electronic weight sensors, connected through a network to a server that monitors the data, may be used to monitor the weight of individual containers of nuclear material located on the sensors. In this case, if a sensor detects a large or rapid change in the weight of a container, an alarm should be activated. To avoid false alarms, there should be an allowance for weight fluctuations that occur naturally, such as those resulting from a change in humidity or air pressure when a door is opened.

Radiation portal monitors and other radiation monitoring equipment

3.58. Radiation portal monitors used to screen personnel as they leave radiation areas can monitor the movement of nuclear material and may be used as a material surveillance measure. Instruments such as hand-held radiation monitors or contamination monitors may also be used for surveillance. Radiation monitoring equipment should be installed at locations (e.g. entrances, exits, gates) and on equipment (e.g. processing pipes, ventilation systems) through which nuclear material could exit a material balance area or the facility in order to reduce the opportunity for the unauthorized removal of nuclear material to occur undetected.

21

Alarms or unusually high readings from any radiation monitors may indicate that nuclear material has been removed without authorization.

3.59. Before installing radiation portal monitors, the conditions of use in the area where the portal monitors would be installed should be evaluated. For example, installing radiation portal monitors on doors in an area where the windows can be easily opened may be inadequate to track movement of radioactive material out of the area. Radiation portal monitors installed for nuclear security should be staffed or other measures should be used to stop a person or vehicle that has caused an alarm from exiting the area.

3.60. The surrounding background radiation should be analysed to establish threshold values for the portal monitors. The threshold value of the monitors should be adjusted to provide good sensitivity for security needs while maintaining a reasonable false alarm rate due to background radiation and other causes. The threshold value should be protected as sensitive information to prevent an insider from using that information to determine the amount of material that could be removed without being detected. The threshold value should be periodically verified through performance testing to ensure that it has not been changed and that the equipment has not degraded or malfunctioned.

3.61. Audible, visual or radio alarms, or a combination of these alarm types, may be used to alert appropriate personnel to readings on a portal monitor above the threshold level. All alarms should be investigated. Where appropriate based on a graded approach, alarms should be reported to the facility’s central alarm station for investigation and resolution.

X ray and metal detection equipment

3.62. X ray and metal detection equipment may be used to reduce the opportunity for unauthorized equipment or other devices (e.g. shielding materials, tools not needed for the authorized tasks) to be taken into a protected area and for nuclear material to be removed from the area without the appropriate procedures being followed. For example, the delivery of personal protective equipment should be closely monitored to ensure that unauthorized material or equipment is not introduced into the area at the same time. Similarly, anything removed from the area should also be monitored to ensure that no nuclear material has been hidden for unauthorized removal. For example, metal shielding used to conceal the unauthorized removal of nuclear material could trigger such a metal detector alarm, or X ray scanning could reveal unauthorized items concealed in material or equipment.

22

TIDs with radio transmitters

3.63. Some modern TIDs are able to exchange radio signals wirelessly with a computer server. Monitoring nuclear material in this way can provide near real-time surveillance of the TID. For example, an alarm may be activated by a signal from the TID indicating that its integrity has been violated or by the TID’s failure to respond to a request from the server for validation of its integrity. Measures should be taken to protect the signals from falsification.

Management and evaluation of surveillance systems

3.64. No single surveillance measure should be considered sufficient to ensure timely detection on its own. A combination of surveillance measures that work together (i.e. a surveillance system) is more effective than any single measure. For example, the two person rule, administrative checks, video surveillance, TIDs and radiation portal monitors may be used simultaneously to minimize the likelihood of an unauthorized removal of nuclear material. The surveillance measures should be coordinated to provide defence in depth at a level appropriate for the quantity and attractiveness of the nuclear material being protected.

3.65. No single individual should be able to control all surveillance systems or hold approvals that could allow that person to modify or block all signals from the surveillance systems. Automating the alarms generated by the surveillance measures and the responses to these alarms can improve efficiency and protection from possible insider threats. The facility operator should maintain logs of alarms and results of alarm investigations.

3.66. The performance of the surveillance measures in areas where they are installed should be periodically evaluated to ensure that the design and application of the system is effective in detecting unauthorized removal of nuclear material or other unauthorized activities. Factors that may degrade performance of surveillance measures should be taken into account. For example, if cameras are used for surveillance, the lighting in the surveillance area and the field of view of the cameras should be adequate to allow a clear view of the area on the associated monitors, and materials and equipment introduced into the area for operational reasons should not obstruct the field of view. An evaluation should be performed to ensure that coverage of the area to be kept under surveillance is complete and effective before dependence on the surveillance system for protection is allowed.

3.67. Compensatory measures should be identified and be available in the case of a malfunction of the primary surveillance measures or when maintenance or

23

repairs take parts of the system out of service. For example, if the equipment controlling access to a nuclear material storage area is being repaired, a temporary guard post may be needed to control entrances to and exits from the storage area during the repair period.

3.68. Procedures should be developed to provide guidance to personnel on the proper operation and implementation of each surveillance measure. The procedures should address how the measure should function as well as how to identify irregularities that may be detected. Surveillance measures should be routinely tested to ensure effective performance. Any defects identified should be corrected and the measures should be retested to ensure appropriate performance.

3.69. The effectiveness of surveillance measures depends on the personnel operating them. Qualified, alert personnel will notice inappropriate actions that may indicate unauthorized removal of nuclear material.

MONITORING NUCLEAR MATERIAL ITEMS

3.70. The facility operator should conduct periodic monitoring of nuclear material items4 (i.e. item monitoring) between physical inventory takings. The monitoring should be based on a statistical sampling plan that defines the sampling method and the population from which samples are taken to be monitored. Information to be verified may include location, item integrity and identification, and TID integrity and identification. The objectives of item monitoring are to detect irregularities in a timely manner and to improve the reliability of and confidence in the NMAC system. Item monitoring can be conducted without interrupting processing operations. Item monitoring is intended to address all nuclear material that is not subject to process monitoring, which is covered in paras 3.75–3.86.

3.71. Individual nuclear material items that have been grouped into a larger container could be identified in the records system as a single nuclear material item. In such cases, the larger nuclear material item forms the basis for item monitoring as long as appropriate control measures have been applied to that larger nuclear material item.

3.72. The sampling plan and the frequency of item monitoring should take into account the attractiveness of the nuclear material, the containment and

4 An ‘item’, as described in this publication, is a discrete container of nuclear material or a discrete piece of nuclear material. It should be possible to assign the item a unique identity.

24

surveillance measures in place where the nuclear material items are located, and past item monitoring results. For example, a history of detecting a large number of irregularities may indicate the need for increased monitoring frequency, an analysis of the root causes of the observed irregularities and the development of a corrective action plan if the root causes of the observed irregularities are determined to be systemic. Examples of irregularities may include a missing item, an item whose TID exhibits evidence of tampering or an item discovered in an incorrect location. The monitoring frequency should be specified in the appropriate facility documents.

3.73. Monitoring of a group of nuclear material items that have similar nuclear material parameters (e.g. type and quantity of nuclear material, radionuclide content, enrichment, gross weight) can be accomplished by verifying a randomly selected sample of items from the group. The number of nuclear material items to be verified (the sample size) should be specified and documented in a written procedure along with the rationale for choosing the sample size. One method for selecting a sample size is described in Appendix I.

3.74. Irregularities identified during the item monitoring process should be investigated and resolved, and the facility’s records should be corrected as necessary.

MONITORING NUCLEAR MATERIAL DURING PROCESSING

3.75. Nuclear material that is undergoing processing can be vulnerable to unauthorized removal, because the material is not in storage and not in the form of an item. Monitoring nuclear material undergoing processing between scheduled physical inventories can provide timely detection of irregularities, and the facility operator should develop and implement procedures for such monitoring. The State’s competent authority may establish detection goals for the quantity of material whose unauthorized removal needs to be detected by monitoring techniques during processing.

3.76. The processes in a facility may be divided into processing units based on factors such as the amount of nuclear material processed or the chemical processes used, so that nuclear material input and output can be measured or estimated for each processing unit. For example, a processing unit could be a single tank, a few tanks and their connecting pipes or an entire technological line.

25

3.77. Process monitoring should take into account how the nuclear material is processed. Process monitoring can be done, for example, by batch [5] (if only one batch is in the processing line at a time), for a technological cycle (sometimes referred to as production cycle or campaign), between cleanouts (when a few batches are processed in sequence within the processing line) or in a continuous process (where processing lines do not have cleanouts and may be working without stops).

3.78. Input–output differences (IODs) are the differences between the quantity of nuclear material that enters a processing unit and the amount of nuclear material that exits that processing unit. Measurements from instruments used to control the process (e.g. flow meters, pressure gauges, temperature gauges and volume measuring devices) can be used to monitor nuclear material during processing and develop an observed IOD for each processing unit.

3.79. An expected IOD should be evaluated for every processing unit, based on an understanding of the process being performed. To perform the input–output analysis, for each processing unit the observed IOD should be compared with the expected IOD to determine whether the difference between the two (loss or gain) is statistically significant. In some cases, additional measurements may be necessary to complete the determination of the IODs.

3.80. All nuclear material, including scrap and waste, should be included in the estimate of output. Losses from a processing unit (e.g. residual material in the process equipment, scrap, samples) are expected, which may lead to difficulties in detecting an unauthorized removal of nuclear material. Sufficient information about the processing unit should be collected and analysed so that normal process variations are understood.

3.81. Observed IODs that exceed a threshold established by the State’s competent authority (e.g. a defined number of standard deviations from the expected IOD) are considered to be significant. Comparisons with such a threshold are more meaningful if the standard deviation of the expected IODs is small. If large expected IODs are common or if the IODs vary widely due to large standard deviations or different processes being performed using the same equipment, it may be necessary to divide the process into more processing units, improve the measurement techniques or apply appropriate criteria for different processes on the same equipment so that the loss of a threshold quantity of nuclear material would be detected.

26

3.82. All statistically significant observed IODs should be investigated and reported to determine whether an unauthorized removal of nuclear material has occurred. It may be necessary to shut down a process until the irregularity has been resolved. Cumulative trends as well as individual observed IODs should be evaluated, as appropriate.

3.83. If processing is done by batch, then the input–output analysis is typically also done by batch. If processing is done by technological cycle, a balance should be calculated between cleanouts. If processing is continuous, a frequency of evaluations should be established and an evaluation should be done for each time period. This frequency will depend on the quantity and attractiveness of the nuclear material being processed and the consequences of losing it. If the time between the beginning and the end of the evaluated process is too long, interim evaluations should be considered.

3.84. For statistical evaluation of process monitoring differences to be meaningful, the process must be stable. If the process, equipment, material and measurements change, the statistical evaluation is compromised. The typical procedure for statistical evaluation is that the expected difference between the input and the output is evaluated for each processing unit. The mean observed IOD for a stable process is typically based on previously established data. The value of the mean observed IOD could be estimated as an absolute value (e.g. 300 g) or as a relative value (e.g. 2% of input).

3.85. Statistical evaluations of observed IODs may be useful for industrial processing facilities in which a relatively small number of processes are used repeatedly. For a research facility, where there may be too much variation in processes to allow for statistical process monitoring, it may be more appropriate to establish other measures for control of the material. An example of how statistical process monitoring can be applied can be found in Appendix II.

3.86. If the process, equipment, material or measurements are changed (e.g. a change in technology is introduced, one of the processing units is replaced), then control values such as expected IODs, their standard deviations and significance thresholds should be re-evaluated and adjusted as needed.

PHYSICAL INVENTORY TAKING

3.87. Physical inventory taking is an accounting measure that not only verifies the inventory of nuclear material, but also tests the effectiveness of nuclear material

27

controls. During a physical inventory taking, the presence, identity and location of, and other relevant information for, each nuclear material item are observed and recorded, and the resulting information is compared with the information in accounting records. Any irregularities identified during the physical inventory taking should be investigated and resolved. Problems with nuclear material control that are identified as a result of physical inventory taking should also be investigated, corrected and resolved. Measures should also be taken to prevent similar nuclear material control problems from occurring in the future.

3.88. Procedures should be established to guide personnel in performing accurate and complete physical inventory taking. Procedures should also be established for identifying any change made to the records or to the nuclear material containers for the purpose of hiding theft or unauthorized removal of nuclear material. Good practices for the physical inventory taking include the following:

— Two (or more) person teams should perform the physical inventory taking; all individuals should be trained and knowledgeable, and should understand the importance of nuclear material control measures.

— Material control measures such as TIDs and container integrity should be verified.

— Duties should be separated so that the person who filled a nuclear material container or prepared records for it is not the same person who performs the physical inventory taking.

3.89. As stated in Ref. [1]:

“Following each physical inventory taking, the total quantity of nuclear material calculated based on the physical inventory should be compared to the total quantity of nuclear material as indicated by the book inventory, and the MUF…should be calculated as part of closing the material balance for that [material balance area].

…….

“For a facility where nuclear material is processed,…a non-zero MUF is to be expected due to uncertainty in measurements and in calculated (non-measured) components of the material balance…. Criteria for evaluating MUF…and limits for MUF should be established by the [State’s] competent authority.”

28

4. MOVEMENT OF NUCLEAR MATERIAL

4.1. Nuclear material may be particularly vulnerable during movements.Therefore, control measures are important during the packing, shipment, receipt, transfer, relocation and unpacking of nuclear material, to prevent unauthorized removal or misuse of the material by an insider.5

4.2. Continuous surveillance is needed throughout the packing, shipment, receipt, transfer, relocation and unpacking processes. Nuclear material should have an assigned accounting value prior to shipment out of the facility or transfer between material balance areas. If nuclear material cannot be measured prior to movement, an estimate of the quantity should be made and additional control measures should be implemented until a measurement can be completed. Measures should be taken to prevent unauthorized nuclear material from being added to, subtracted from or substituted for the authorized movement. For example, controls such as visual inspections should be in place to ensure that containers labelled as ‘empty’ do not contain unauthorized nuclear material.

SHIPMENTS OF NUCLEAR MATERIAL

4.3. The facility operator should develop procedures for maintaining control of nuclear material during shipment that address each type of nuclear material item that may be shipped.

4.4. Prior to shipment, if required by the State’s competent authority, the shipper should notify the State’s competent authority and provide information regarding the shipment and should not ship the nuclear material until authorization has been received from the State’s competent authority.

4.5. Prior to shipment, the shipper should notify the receiver of the plan to ship the nuclear material. The shipper should ensure that the shipment meets

5 In Ref. [1], as in the current publication:

“the term ‘shipment’ refers to an outgoing movement of nuclear material from one facility to another facility. The term ‘receipt’ refers to an incoming movement of nuclear material from one facility to another facility. The term ‘transfer’ refers to nuclear material movement within a facility between [material balance areas]. The term ‘relocation’ refers to movement within [a material balance area]. The general term ‘movement’ refers to all terms defined in this paragraph and used in this publication.”

29

all requirements to transport the material and that the receiver is authorized to receive the material.

4.6. Shipments of nuclear material should be made using only containers approved and certified by the State’s competent authority in accordance with relevant international obligations and domestic legislation. Shipments across national borders may require an export licence.

4.7. TIDs should be applied to the nuclear material items that will be shipped, and the items should be kept under material surveillance throughout the shipping process, including during preparation for shipment. Before the nuclear material items leave the facility, the identity and integrity of the TIDs being used should be verified. In some situations, other nuclear material parameters (e.g. gross weight) should be verified prior to shipment. For example, if the nuclear material to be shipped was packaged several months prior to shipment, the nuclear material parameters of the nuclear material should be verified immediately prior to shipment.

4.8. The shipper should ensure that the packing and shipping documents to be sent to the receiver include unique identification of all nuclear material items to be shipped. The shipper should also maintain a record of all nuclear material items being shipped, including nuclear material parameters (e.g. nuclear material, quantity, isotopic content, element concentration, enrichment of each item (if required), gross weight). If required by the State’s competent authority, the measurement uncertainty should also be included in the records. The shipping containers and TIDs should be visually inspected for any signs of tampering. Once the nuclear material has been shipped and confirmation of receipt has been provided, the shipper’s book inventory should be updated to include this information.

RECEIPT OF NUCLEAR MATERIAL

4.9. The facility operator should develop and implement procedures to be followed by facility personnel on the proper actions to take when receiving nuclear material from another facility. The receiving facility should use verification measurements to confirm that the nuclear material received is the same material and quantity that was shipped and to confirm that the nuclear material controls associated with the shipment were effective.

30

4.10. Upon receipt of the material, verification measurements should be performed by a minimum of two personnel, and the verification measurements should be specific to the type and form of the nuclear material in the shipment. The verification measurements should include:

— Verification of the integrity of the shipping containers; — Verification that the unique identification numbers associated with the nuclear material items are the same as those given in the shipping documents;

— Verification that the number of nuclear material items in the shipping container is the same as is stated in the shipping documents;

— Verification of the unique identification numbers of any TIDs and their integrity;

— Verification of the measurements of nuclear material parameters recorded by the shipper, such as nuclear material, quantity, isotopic content, element concentration, enrichment of each item (if required) and gross weight, as appropriate.

4.11. Nuclear material received from another facility should be isolated and secured, and should not be processed or used until the verification measurements are complete and all irregularities (i.e. differences between what the shipper recorded and the receiver found) have been resolved. Any irregularities discovered during the verification measurements should be reported to the shipper and the State’s competent authority. The procedures should describe how irregularities should be investigated and resolved. The State’s competent authority should specify the time period within which verification measurements are completed and any irregularities are resolved. Nuclear material items should be entered in the facility records following completion of the receipt verification measurements. If appropriate, records should be updated to reflect the receiver’s measurements.

SHIPPER–RECEIVER DIFFERENCE EVALUATION

4.12. The receiver’s measured values for the nuclear material received should be compared with the information contained in the shipping documents. The difference between the receiver’s and the shipper’s values is referred to as the shipper–receiver difference (SRD). Some differences between shipper and receiver measurements of the same nuclear material are to be expected, typically due to measurement error. Evaluation of these differences is important for

31

determining if the receiver received the same nuclear material recorded by the shipper.

4.13. The facility operator should develop and implement procedures for evaluating SRDs. SRD evaluation consists of comparing the difference between the quantity measured by the shipper and that measured by the receiver to a critical value that is usually calculated using the shipper’s and the receiver’s measurement variances. The State’s competent authority should specify the criteria for the acceptable range of SRDs.

4.14. An SRD outside the range of SRDs considered acceptable by the State’s competent authority (i.e. an excessive SRD) could result from faulty measurements by the shipper or the receiver, or from errors in the shipping documents. However, it could also mean that nuclear material has been removed or added without authorization. Any SRD that is excessive should be investigated and resolved, and the results of the investigation should be recorded. Procedures should be developed to guide personnel in investigating and resolving an excessive SRD. Resolution of an excessive SRD may need independent measurements by a third party.

4.15. In addition to calculation and evaluation of SRDs for single nuclear material items, SRDs can be calculated and evaluated for batches or for entire shipments. Cumulative SRDs should also be calculated, and trends should be analysed to look for systematic errors or protracted unauthorized removals of nuclear material.

TRANSFERS AND RELOCATIONS WITHIN A FACILITY

4.16. The facility operator should develop and implement clear procedures for transferring nuclear material between material balance areas or relocating material within material balance areas, with the purpose of deterring and detecting unauthorized removal or substitution of nuclear material during transfers and relocations. These procedures should include instructions for investigating and resolving any irregularities identified during the verification process.

Transfers between material balance areas within a facility

4.17. Before transfers are made between material balance areas, they should be approved in accordance with facility procedures. Personnel in the transferring material balance area should notify personnel in the receiving material balance

32

area of the quantity (i.e. a measured value or reasonable estimate) and the form of the materials to be transferred. Personnel in the receiving material balance area should confirm that receipt would not violate any operational, regulatory or safety limits. The same personnel should not be working in both the transferring material balance area and the receiving material balance area. Separation of duties should be maintained to ensure that the same person cannot both transfer and receive the nuclear material.

4.18. Prior to transfer, personnel in the transferring material balance area should confirm that the nuclear material being prepared for transfer is the material that is intended for transfer. Transfers between material balance areas should be recorded in a timely manner. The time during which the nuclear material is in transit should be minimized.

4.19. Upon acceptance of nuclear material items in the receiving material balance area, the transfer should be verified. The verification should include, as appropriate:

— Verification of the integrity of the containers; — Verification that the unique identification numbers associated with the nuclear material items are the same as those given in the shipping documents;

— Verification that the number of nuclear material items in the shipping container is the same as that stated in the shipping documents;

— Verification of the unique identification numbers of any TIDs and their integrity;

— Verification of the measurements of nuclear material parameters recorded by the shipping material balance area, such as isotopic composition, as required by facility procedures.

4.20. In processing facilities, there may be transfers of nuclear material between material balance areas that are not in individual item form (e.g. a liquid stream that flows through a pipe from one material balance area to another). In this case, controls should be established to reduce the opportunity for unauthorized removal to occur during the transfer. For example, the volume, level, elemental concentration and isotopic content of material in bulk form may be measured before and after the transfer.

4.21. Procedures should be developed and implemented for controlling analytical samples transferred to a laboratory. Before and after the samples are transferred, the gross and net weights of the samples should be recorded. Upon completion of

33

the analysis, the element and isotopic content should be updated in the facility’s records. The same consideration should be given to relocations of analytical samples within a material balance area. Procedures for investigating and resolving differences when transferring nuclear material between material balance areas should be developed based on the guidance on SRDs in paras 4.12–4.15.

Relocations within a material balance area

4.22. In some facilities, a single material balance area may include nuclear material in more than one location (buildings or rooms). Relocations within a material balance area may involve movements of nuclear material within a room, between rooms in a building or between buildings. While relocations are typically less vulnerable than shipments or transfers, they should be carefully prepared and conducted. Procedures for control measures should be based on a graded approach and should be appropriate for the type of relocation. For example, the controls for relocation of nuclear material between buildings may be more stringent than the controls for relocations between rooms within a single building.

4.23. During relocation, nuclear material should not be left uncontrolled. Depending on the categorization of the material, the containment of the nuclear material or continuous presence of authorized personnel (i.e. the two person rule or equivalent) may be required. If the relocation is to take place overnight or during more than one work shift, the application of a TID should be considered. There should be clear agreement of the point in time at which custodial responsibility for the nuclear material changes.

4.24. Checks should be made when nuclear material is relocated within a material balance area. Such checks are normally limited to verification of the identity of the nuclear material items, the integrity of the items or of the containers, the location and any TIDs applied. While remeasurement is normally not necessary, it might be considered if TIDs will be applied to nuclear material that did not previously contain a TID, or if the scales or measurement equipment at the new location are more accurate than those at the previous location.

4.25. Near real-time updates of the records system should be made to reflect relocation of nuclear material within a material balance area. Any irregularities should be investigated and resolved in accordance with the facility’s formal procedures.

34

5. RESPONSE TO IRREGULARITIES IN NUCLEAR MATERIAL CONTROL

5.1. An irregularity is an unusual event or condition that could be an indication of an attempt at unauthorized removal or misuse of nuclear material. As stated in Ref. [1], “for each facility, criteria should be established for defining what constitutes an irregularity.” When an irregularity is detected, an investigation into its cause should be initiated. Facility management and the State’s competent authority should be notified of irregularities in accordance with the reporting requirements and facility procedures of the State’s competent authority. A graded approach should be applied to responding to and reporting irregularities.

5.2. Procedures for response to irregularities should be developed and implemented, including formal investigation and reporting procedures. Some irregularities may require that physical protection personnel implement compensatory measures to prevent unauthorized removal of nuclear material. This may involve preventing personnel from exiting a material balance area, a building or the facility until the investigation is completed and the irregularity is resolved. Personnel working with nuclear material should understand that they are responsible for taking appropriate action and reporting irregularities, as part of a strong nuclear security culture. Examples of possible types of irregularities are provided in Ref. [1].

INVESTIGATION

5.3. During an investigation, the possibility should be considered that an irregularity was created intentionally to determine whether it would be detected in a timely manner or to disguise unauthorized removal. Some irregularities, such as the loss of an item, call for an immediate response. Other irregularities, such as recording errors, should be carefully evaluated as they may indicate a serious problem with the NMAC system. Where possible, all nuclear material items associated with a possible irregularity should be isolated in separate storage areas or protected until the issue is resolved [1].

5.4. The possibility of unauthorized removal of nuclear material should be considered when investigating all irregularities, even in cases with no initial indication of unauthorized removal or actions preparatory to such. If there are apparent indications of unauthorized removal, physical protection personnel should be notified so that they may implement appropriate measures.

35

5.5. Irregularities should be investigated following established procedures. Depending on the results of the investigation, notifications should be made to the appropriate facility managers and the State’s competent authority, as required or appropriate. Information needed to assist the investigation may include logs, records of TIDs or other facility records. The investigation should include determination of the cause of the irregularity.

5.6. Personnel who are experienced in NMAC should be involved in the investigation, and each investigation should be specific to the particular irregularity discovered. Procedures may be developed for the routine steps to be taken in an investigation, but NMAC personnel should determine the case specific steps.

5.7. Investigations should continue until the irregularity is resolved or all possible explanations for the existence of the irregularity have been exhausted. The State’s competent authority should establish time limits allowed for investigations and reporting of irregularities.

5.8. Possible investigative actions are described in paras 5.9–5.20.

Irregularities found during item monitoring

5.9. The discovery during item monitoring that a nuclear material item is not in its recorded location is an irregularity. Attempts should first be made to locate the nuclear material item by conducting a search of the area adjacent to where the nuclear material item should be located and reviewing the operations and accounting records for any inaccurately recorded movements of the nuclear material item. For example, an entry indicating that an item was moved might have been made in the records maintained for operational purposes, but the movement might not have been recorded in the NMAC system.

5.10. If the nuclear material item cannot be located with these actions, physical protection personnel should be notified so that they may implement measures to control exits from the facility, to reduce the opportunity for an insider to remove the nuclear material item from the facility. Simultaneously, the NMAC personnel should begin an emergency physical inventory taking,6 beginning with the material balance area or location where the irregularity was discovered. If

6 An ‘emergency physical inventory taking’ in this publication, refers to a physical inventory that is performed in response to the discovery of an irregularity rather than an emergency in the sense of a safety emergency.

36

the nuclear material item is not located during this limited emergency physical inventory taking, the area in which the inventory is performed should be widened, including a full emergency physical inventory taking of the facility, if necessary.

Irregularities related to tamper indicating devices (TIDs)

5.11. A TID that is broken or missing, or that shows other signs of having been tampered with, is an irregularity. To resolve this irregularity, the records maintained for operational purposes, the accounting records and the TID records should be reviewed. As part of the investigation, nuclear material in the container should be measured to ensure that the contents of the container have not changed. If the cause of the irregularity is not identified, or if the measurement indicates the loss of nuclear material, personnel involved in the activities that led to the identification of the irregularity should be interviewed. If the interviews do not reveal the cause of the irregularity, an emergency physical inventory taking should be conducted, beginning with the affected material balance area, and if needed, at the facility level. Physical protection personnel should be notified so that they may implement control measures to prevent the removal of any nuclear material from the facility until the investigation is complete.

Irregularities found during physical inventory taking: Material unaccounted for (MUF)

5.12. The discovery during a physical inventory taking of MUF that exceeds the limits established by the State’s competent authority (i.e. excessive MUF) is an irregularity and should be investigated and resolved. The quantities of nuclear material should be verified to ensure that the records are correct and do not contain transposition errors or duplications. The uncertainties associated with the quantity measurements should be reviewed to determine that their contributions to the potential MUF have been calculated correctly. If the irregularity is not resolved through these actions, a limited emergency physical inventory taking should be performed in the affected material balance area. If the limited emergency physical inventory taking does not resolve the irregularity, the area in which the inventory is performed should be widened.

5.13. Investigation activities should include confirmation that containment and surveillance measures were not compromised during the inventory period and that there were no unresolved alarms. NMAC personnel should always be alert to the possibility of unauthorized removal of nuclear material when excessive MUF is discovered and should take appropriate action to work with physical protection personnel to resolve the irregularity.

37

5.14. The minimum response for excessive MUF should be a documented investigation conducted by NMAC personnel. The investigation report should provide a conclusion on the probable cause of the irregularity and recommendations for avoiding recurrences. In general, the investigation of excessive MUF should follow facility procedures established for the investigation and include:

— Examination of the inventory and shipper–receiver records for accounting errors;

— Comparison of the observed MUF with historical data; — Assessment of whether the observed MUF could result from process changes;

— Confirmation that all items recorded in facility records are present and identification of items requiring further investigation;

— Detailed analysis of the accounting system, including a complete audit of records, a review of the measurement system and an inventory of the facility.

Irregularities found during monitoring of material undergoing processing: Input–output discrepancies (IODs)

5.15. The discovery during process monitoring of an IOD that is statistically significant (i.e. exceeds an established threshold) is an irregularity. If such an irregularity is discovered, the accounting records should be reviewed by personnel who are familiar with NMAC. The quantities of nuclear material should be verified to ensure that the quantities recorded as inputs and outputs do not include mistakes (e.g. transposition errors or duplications), and that the calculations for the error limits are correct. The input and output records from each of the processing units should also be reviewed to determine whether offsetting gains or losses might explain the irregularity. Processing equipment may be tested to investigate if the IOD is due to an equipment malfunction.

5.16. If an examination of the records does not reveal errors, relevant parameters of the nuclear material associated with the irregularity should be verified through measurement.

5.17. If verifying the accounting records and repeating the nuclear material measurements does not resolve the irregularity, personnel involved in the movement of the material should be interviewed. For example, where applicable, it should be determined whether the two person rule was implemented correctly to ensure that procedures were followed. Personnel involved in the movement

38

should be asked whether they noticed anything unusual during the movement of the material. A process malfunction could lead to a difference between the quantity of nuclear material that was recorded as transferred and that which was actually transferred. NMAC and operations personnel should work together to resolve the irregularity.

5.18. If necessary, operations in the processing unit with the excessive IOD should be discontinued until the irregularity is resolved. If the irregularity is not resolved by the actions described above, more extensive actions may be necessary (e.g. an emergency physical inventory taking or, if indicated, cleanout of equipment for the affected processing unit), and physical protection personnel should be notified so that they may implement compensatory measures to reduce the likelihood of an unauthorized removal of nuclear material from the facility.

Irregularities found during material receipts: Shipper–receiver difference (SRD)

5.19. If, following the receipt of nuclear material into a facility, an SRD is calculated that is outside the acceptable range established by the State’s competent authority (i.e. excessive SRD), an investigation should be conducted. The investigation should determine whether there were any indications of possible unauthorized removal of nuclear material during the shipping and receiving process. Personnel at the receiving facility should be interviewed to identify any unusual activities or discoveries that might indicate tampering. The shipping facility operator and transport operator or authority should be contacted to determine whether events occurred that could have caused a lapse in material control during the shipping and transport process.

5.20. The accounting records of the individual nuclear material items in the shipment should be reviewed. This review should include verifying the accuracy of the data for each of the items. The calculations for the error limits should also be reviewed. If examining the records does not reveal errors, the mass of the nuclear material items in the shipment should be verified through measurement.

CORRECTIVE ACTIONS

5.21. Irregularities should be systematically investigated to identify factors contributing to the irregularities and their causes, for example, using a root cause analysis. All contributing factors and causes identified in the investigation should be addressed by developing and implementing corrective actions to mitigate

39

them. If the facility has a corrective action programme, the irregularity and the response to it should be entered and tracked in the appropriate corrective action record system.

5.22. All investigations should be recorded and should include details regarding the corrective actions taken following the investigation. Records of the investigations should be maintained and reviewed for trends that may indicate the need for further investigation. Time limits should be established by the facility operator for correcting irregularities, to the extent possible.

5.23. The corrective actions needed to address an irregularity depend on the type and severity of the irregularity. For example, if a nuclear material item thought to be missing is found because it was moved to another location without appropriate changes to the accounting records, records should be corrected to reflect the actual situation and an investigation should be undertaken to determine the cause of the incorrect records. In a situation where a missing nuclear material item is not found, further steps are needed to locate the item, such as searching other material balance areas. Physical protection measures, such as restricting exits from the facility, are necessary if the nuclear material item is not located.

5.24. Facility procedures should specify the level of management that is responsible for approving corrective actions taken following the investigation and, where appropriate, the required notification to the State’s competent authority.

5.25. A follow-up evaluation should be conducted to ensure that corrective actions taken to address the irregularity are effective. Irregularities should be monitored to identify trends that could be indicative of insider attempts at unauthorized removal of nuclear material from the facility.

REPORTING

5.26. All irregularities should be reported to facility management and to the State’s competent authority, if required. Procedures for reporting irregularities should already be in place when an irregularity is detected and should not be developed in response to an irregularity, although they may be amended. The State’s competent authority should establish time limits for reporting irregularities.

40

5.27. The discovery of an irregularity, investigation of the irregularity and measures taken to correct the irregularity should be recorded. The State’s competent authority should establish requirements for the content of the report, such as a description of the irregularity, the time and date of discovery, the steps taken to investigate the irregularity, and the corrective actions planned and taken.

6. EVALUATION OF NUCLEAR MATERIAL CONTROL

6.1. Nuclear material control should be periodically evaluated to determine whether all necessary measures are in place and functioning as required by the State’s competent authority, and whether they are effective for detecting unauthorized use or removal of nuclear material.

6.2. A facility’s nuclear material control measures should be evaluated on a periodic or as-needed basis by trained and qualified NMAC personnel of the facility or by qualified independent personnel. Independent personnel may be from another part of the facility or may be external to the facility, such as invited experts from an organization that specializes in NMAC. Inspectors from the State’s competent authority should also perform evaluations. The individuals performing the evaluations should not have any conflicts of interest such as having direct responsibility for the activities being evaluated.

6.3. Procedures should be developed for evaluating the effectiveness of nuclear material control on a routine and as-needed basis. The use of vulnerability studies, including scenario development, should be considered. One method of evaluating nuclear material control measures is through performance testing — that is, testing to determine whether or not the measure is implemented as designed; is adequate for the proposed natural, industrial and threat environments; and is in compliance with established performance requirements.

6.4. All performance tests should be planned in advance and approved by the NMAC manager and other appropriate managers (e.g. physical protection managers, operations managers). The plan should include a description of the test, a list of the personnel who should be involved, identification of the area where the test will be performed, expected results and actions to be taken in the event of the discovery of an irregularity. Compensatory measures should be taken during any performance test to ensure that nuclear material is not made more vulnerable during the test.

41

6.5. Nuclear material control measures should be tested as part of the evaluation of the NMAC system to ensure that the system can detect unauthorized access to nuclear material or other actions that could lead to unauthorized removal or misuse of nuclear material. Nuclear material control measures may be evaluated by the introduction of simulated irregularities (e.g. an indication of a broken TID on a container of nuclear material) to check that the measures are capable of detecting the irregularity when they are implemented as described in the facility’s procedures. When an irregularity is simulated, control of the item must still be maintained to ensure the item’s integrity.

6.6. Compliance with nuclear material control procedures should be evaluated. For example, an assessor may choose to evaluate the procedure for accessing a storage room containing nuclear material or for approval of movements of nuclear material between material balance areas. One method of evaluating the implementation of procedures is to ascertain through interviews how well personnel understand the procedures. Another method is to observe evaluated activities as they are taking place. This method may be considered a performance test, particularly if the assessor introduces a simulated irregularity.

6.7. The results of evaluations should be recorded and reported as required. Deficiencies identified during evaluations should be properly recorded. Corrective actions should be sufficient to prevent the recurrence of the deficiency, as described in paras 5.21–5.25. Individual deficiencies should be evaluated to determine whether unauthorized removal of nuclear material may have occurred or may have been attempted. Analyses of all cumulative deficiencies should be conducted to identify any possible trends that might indicate attempted unauthorized removal of nuclear material.

7. INTERFACE WITH THE PHYSICAL PROTECTION SYSTEM

7.1. Day-to-day activities that involve nuclear material require ongoing coordination between the NMAC and physical protection personnel within a facility. Physical protection measures and NMAC measures should be coordinated and should complement one another. The same technical measures may serve purposes for both physical protection and NMAC. For example, video cameras installed in nuclear material storage areas can be considered both a physical protection and a material control measure. However, for the camera

42

to be effective as a material control measure, it is important that there be a procedure for the camera to be used as a control measure and that the operator or guard reviewing the video signal be trained to distinguish authorized actions from unauthorized actions.

7.2. The facility operator should assess and manage the interface between physical protection and nuclear material control activities to prevent these activities from adversely affecting each other. The activities should be mutually supportive, to the extent possible. For example, if nuclear material needs to be moved out of a locked and alarmed storage area for relocation to another area or for processing, both NMAC and physical protection personnel should be involved in planning and executing the relocation. In addition, both NMAC and physical protection personnel should be involved when nuclear material areas are initially accessed at the start of the work shift or need to be secured before the end of the work shift. These types of regular interaction may improve the sharing of information between NMAC personnel and physical protection personnel.

7.3. When the NMAC system detects an irregularity, the information communicated between material control personnel and NMAC personnel should be recorded, as appropriate. Investigations of irregularities should be coordinated with physical protection personnel. For example, if there is an indication that nuclear material may be missing (e.g. a broken TID on a storage room door) or if an irregularity has occurred, physical protection personnel should be notified and information from the physical protection system (e.g. sensor alarms, video surveillance records, personnel access control records) should be reviewed. Similarly, the investigation should take into account information from the facility’s NMAC system. One or both systems may provide information that is beneficial to the overall investigation.

7.4. Facility procedures should specify when NMAC personnel should notify physical protection personnel and other response organizations and involve them in an investigation. Some situations call for immediate notification, while others may allow for initial investigation by NMAC personnel before physical protection personnel are involved.

43

Appendix I

SELECTING A SAMPLE SIZE FOR ITEM MONITORING

I.1. The following equation provides an example of a formula for calculating the needed sample size for item monitoring:

n = N (1 – β1/d) = N (1 – βx/G) (1)

where

n is the number of nuclear material items to be randomly selected (sample size);

N is the total number of nuclear material items within the population to be tested (the stratum);

β is such that (1 – β) is the desired probability of obtaining at least one irregularity among the sample of items chosen for verification (e.g. for a 99% probability, β would be 0.01);

G is the quantity of nuclear material whose unauthorized removal should be detected by item monitoring with the desired probability;

d is the minimum number of individual irregularities that could together make up the quantity G;

and x is the average mass of nuclear material within a single item for the stratum being tested.

I.2. The number d is a function of the amount of nuclear material per item. If the nuclear material content varies significantly from item to item, the largest value should be used to calculate d to ensure that n is large enough to guarantee that the probability of detection is at the desired level. This results in a conservative value of n. 1/d is equivalent to x/G.

I.3. As an example, assume that a given nuclear material item stratum consists of 1000 items, each containing 100 g of 235U. To detect with 99% probability whether 5000 g of 235U has been removed from this item group by an insider, first calculate the minimum number of irregularities that would be necessary to accumulate 5000 g of 235U, which is 50 items (100 g 235U per item multiplied by 50 items = 5000 g of 235U). Using Eq. (1), the sample size n would be 88 items. Accordingly, there would be a 99% probability that at least 1 of the 50 or more irregularities would be among the 88 selected items.

44

Appendix II

STATISTICAL EVALUATION FOR MONITORING NUCLEAR MATERIAL IN PROCESSING

II.1. The following is an example of the statistical evaluation for monitoring nuclear material in a processing area.

II.2. Suppose a processing unit processes a mixture of plutonium oxide and uranium oxide powder. All batches are approximately the same size. The material put into the processing unit undergoes three operations: jet milling, sieving and lot blending. After blending, the material is removed from the processing unit. The process IOD is calculated as the difference between the amount of material put into the processing unit and the amount of material taken out of the processing unit.

II.3. Each evaluation test should have a defined action threshold that, if exceeded, initiates alarm resolution procedures for determining whether an unauthorized removal of nuclear material has occurred. An example of this threshold is set by a basic model as follows:

A = xm +/– Kσx (2)

where

A is the action threshold value of the input–output difference (IOD);xm is the mean value of the IOD;K is the factor (number of standard deviations) chosen to reflect the desired

probability of detection (for example 1.65 standard deviations to achieve a 95% detection probability);

and σx is the standard deviation of the IOD.

Suppose that the mean IOD is 1539 g and the standard deviation is 483 g.

A = 1539 +/– 1.65 (483)

Ninety-five per cent of the time, the expected result would be between 772 and 2336. If the IOD is outside those limits, action should be taken.

45

Appendix III

MODEL FOR CALCULATING THE STANDARD ERROR OF A SHIPPER–RECEIVER DIFFERENCE

III.1. The following is an example of a basic model for calculating the total standard error of parameters that should be measured (i.e. gross weight, elemental concentration, isotopic composition):

Total standard deviation = s sS R( ) + ( )2 2 (3)

where σS is the shipper’s measurement standard error and σR is the receiver’s measurement standard error.

III.2. If the shipper’s measurement uncertainty values are not available, the receiver can use the receiver’s measurement uncertainty as the shipper’s measurement uncertainty, in which case the measurement standard error is (2σR

2)1/2=1.414σR, or can set the value of the shipper’s uncertainty to zero.

EXAMPLE OF A SHIPPER–RECEIVER DIFFERENCE EVALUATION

III.3. Suppose a fuel manufacturing facility receives a single cylinder filled with low enriched uranium (less than 5% enrichment). The shipping documents indicate that the gross weight of the UF6 cylinder is 8101 kg. The measurement uncertainty for the scale used by the shipper is 0.05%. The fuel manufacturing facility weighs the cylinder and obtains a gross weight of 8080 kg. The measurement uncertainty for the scale used by the fuel manufacturing facility is 0.10%.

III.4. The State’s competent authority has established a requirement that the critical value for an SRD is twice the total standard deviation. If the limits are established at two standard deviations, the risk of concluding that there is a difference when in reality there is no difference is approximately 5%.

46

III.5. Using the example above, what is the amount of the SRD and is it significant?

Shipper gross weight: 8101 kg Relative standard error: 0.05%

Receiver gross weight: 8080 kg Relative standard error: 0.10%

Shipper–receiver difference: 8101 – 8080 = 21 kg

Total measurement variance: (8101 × 0.0005) 2 + (8080 × 0.0010) 2 = 81.693

Total standard deviation: 9.038 kg

Critical value (2 × total standard deviation): ±18.076 kg

Because the SRD (21 kg) falls outside the acceptable limits (±18.076 kg), it is considered to be significant and requires further investigation.

47

REFERENCES

[1] INTERNATIONAL ATOMIC ENERGY AGENCY, Use of Nuclear Material Accounting and Control for Nuclear Security Purposes at Facilities, IAEA Nuclear Security Series No. 25-G, IAEA, Vienna (2015).

[2] INTERNATIONAL ATOMIC ENERGY AGENCY, Preventive and Protective Measures against Insider Threats, IAEA Nuclear Security Series No. 8, IAEA, Vienna (2008).

[3] INTERNATIONAL ATOMIC ENERGY AGENCY, Objective and Essential Elements of a State’s Nuclear Security Regime, IAEA Nuclear Security Series No. 20, IAEA, Vienna (2013).

[4] INTERNATIONAL ATOMIC ENERGY AGENCY, Sustaining a Nuclear Security Regime, IAEA Nuclear Security Series No. 30-G, IAEA, Vienna (2018).

[5] INTERNATIONAL ATOMIC ENERGY AGENCY, Security of Nuclear Material in Transport, IAEA Nuclear Security Series No. 26-G, IAEA, Vienna (2015).

[6] INTERNATIONAL ATOMIC ENERGY AGENCY, Nuclear Material Accounting Handbook, IAEA Services Series No. 15, IAEA, Vienna (2008).

[7] INTERNATIONAL ATOMIC ENERGY AGENCY, Nuclear Security Recommendations on the Physical Protection of Nuclear Material and Nuclear Facilities (INFCIRC/225/Revision 5), IAEA Nuclear Security Series No. 13, IAEA, Vienna (2011).

[8] INTERNATIONAL ATOMIC ENERGY AGENCY, Security of Nuclear Information, IAEA Nuclear Security Series No. 23-G, IAEA, Vienna (2015).

[9] INTERNATIONAL ATOMIC ENERGY AGENCY, Nuclear Security Culture, IAEA Nuclear Security Series No. 7, IAEA, Vienna (2008).

[10] FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL CIVIL AVIATION ORGANIZATION, INTERNATIONAL LABOUR ORGANIZATION, INTERNATIONAL MARITIME ORGANIZATION, INTERPOL, OECD NUCLEAR ENERGY AGENCY, PAN AMERICAN HEALTH ORGANIZATION, PREPARATORY COMMISSION FOR THE COMPREHENSIVE NUCLEAR-TEST-BAN TREATY ORGANIZATION, UNITED NATIONS ENVIRONMENT PROGRAMME, UNITED NATIONS OFFICE FOR THE COORDINATION OF HUMANITARIAN AFFAIRS, WORLD HEALTH ORGANIZATION, WORLD METEOROLOGICAL ORGANIZATION, Preparedness and Response for a Nuclear or Radiological Emergency, IAEA Safety Standards Series No. GSR Part 7, IAEA, Vienna (2015).

[11] FOOD AND AGRICULTURE ORGANIZATION OF THE UNITED NATIONS, INTERNATIONAL ATOMIC ENERGY AGENCY, INTERNATIONAL LABOUR OFFICE, PAN AMERICAN HEALTH ORGANIZATION, UNITED NATIONS OFFICE FOR THE COORDINATION OF HUMANITARIAN AFFAIRS, WORLD HEALTH ORGANIZATION, Arrangements for Preparedness for a Nuclear or Radiological Emergency, IAEA Safety Standards Series No. GS-G-2.1, IAEA, Vienna (2007).

@ No. 25

ORDERING LOCALLYIn the following countries, IAEA priced publications may be purchased from the sources listed below or from major local booksellers. Orders for unpriced publications should be made directly to the IAEA. The contact details are given at the end of this list.

CANADARenouf Publishing Co. Ltd22-1010 Polytek Street, Ottawa, ON K1J 9J1, CANADATelephone: +1 613 745 2665 Fax: +1 643 745 7660Email: order@renoufbooks.com Web site: www.renoufbooks.com

Bernan / Rowman & Littlefield15200 NBN Way, Blue Ridge Summit, PA 17214, USATel: +1 800 462 6420 • Fax: +1 800 338 4550Email: orders@rowman.com Web site: www.rowman.com/bernan

CZECH REPUBLICSuweco CZ, s.r.o.Sestupná 153/11, 162 00 Prague 6, CZECH REPUBLICTelephone: +420 242 459 205 Fax: +420 284 821 646Email: nakup@suweco.cz Web site: www.suweco.cz

FRANCEForm-Edit5 rue Janssen, PO Box 25, 75921 Paris CEDEX, FRANCETelephone: +33 1 42 01 49 49 Fax: +33 1 42 01 90 90Email: formedit@formedit.fr Web site: www.form-edit.com

GERMANYGoethe Buchhandlung Teubig GmbHSchweitzer FachinformationenWillstätterstrasse 15, 40549 Düsseldorf, GERMANYTelephone: +49 (0) 211 49 874 015 Fax: +49 (0) 211 49 874 28Email: kundenbetreuung.goethe@schweitzer-online.de Web site: www.goethebuch.de

INDIAAllied Publishers1st Floor, Dubash House, 15, J.N. Heredi Marg, Ballard Estate, Mumbai 400001, INDIATelephone: +91 22 4212 6930/31/69 Fax: +91 22 2261 7928Email: alliedpl@vsnl.com Web site: www.alliedpublishers.com

Bookwell3/79 Nirankari, Delhi 110009, INDIATelephone: +91 11 2760 1283/4536Email: bkwell@nde.vsnl.net.in Web site: www.bookwellindia.com

@ No. 25

ORDERING LOCALLYIn the following countries, IAEA priced publications may be purchased from the sources listed below or from major local booksellers. Orders for unpriced publications should be made directly to the IAEA. The contact details are given at the end of this list.

CANADARenouf Publishing Co. Ltd22-1010 Polytek Street, Ottawa, ON K1J 9J1, CANADATelephone: +1 613 745 2665 Fax: +1 643 745 7660Email: order@renoufbooks.com Web site: www.renoufbooks.com

Bernan / Rowman & Littlefield15200 NBN Way, Blue Ridge Summit, PA 17214, USATel: +1 800 462 6420 • Fax: +1 800 338 4550Email: orders@rowman.com Web site: www.rowman.com/bernan

CZECH REPUBLICSuweco CZ, s.r.o.Sestupná 153/11, 162 00 Prague 6, CZECH REPUBLICTelephone: +420 242 459 205 Fax: +420 284 821 646Email: nakup@suweco.cz Web site: www.suweco.cz

FRANCEForm-Edit5 rue Janssen, PO Box 25, 75921 Paris CEDEX, FRANCETelephone: +33 1 42 01 49 49 Fax: +33 1 42 01 90 90Email: formedit@formedit.fr Web site: www.form-edit.com

GERMANYGoethe Buchhandlung Teubig GmbHSchweitzer FachinformationenWillstätterstrasse 15, 40549 Düsseldorf, GERMANYTelephone: +49 (0) 211 49 874 015 Fax: +49 (0) 211 49 874 28Email: kundenbetreuung.goethe@schweitzer-online.de Web site: www.goethebuch.de

INDIAAllied Publishers1st Floor, Dubash House, 15, J.N. Heredi Marg, Ballard Estate, Mumbai 400001, INDIATelephone: +91 22 4212 6930/31/69 Fax: +91 22 2261 7928Email: alliedpl@vsnl.com Web site: www.alliedpublishers.com

Bookwell3/79 Nirankari, Delhi 110009, INDIATelephone: +91 11 2760 1283/4536Email: bkwell@nde.vsnl.net.in Web site: www.bookwellindia.com

ITALYLibreria Scientifica “AEIOU”Via Vincenzo Maria Coronelli 6, 20146 Milan, ITALYTelephone: +39 02 48 95 45 52 Fax: +39 02 48 95 45 48Email: info@libreriaaeiou.eu Web site: www.libreriaaeiou.eu

JAPANMaruzen-Yushodo Co., Ltd10-10 Yotsuyasakamachi, Shinjuku-ku, Tokyo 160-0002, JAPANTelephone: +81 3 4335 9312 Fax: +81 3 4335 9364Email: bookimport@maruzen.co.jp Web site: www.maruzen.co.jp

RUSSIAN FEDERATIONScientific and Engineering Centre for Nuclear and Radiation Safety107140, Moscow, Malaya Krasnoselskaya st. 2/8, bld. 5, RUSSIAN FEDERATIONTelephone: +7 499 264 00 03 Fax: +7 499 264 28 59Email: secnrs@secnrs.ru Web site: www.secnrs.ru

UNITED STATES OF AMERICABernan / Rowman & Littlefield15200 NBN Way, Blue Ridge Summit, PA 17214, USATel: +1 800 462 6420 • Fax: +1 800 338 4550Email: orders@rowman.com Web site: www.rowman.com/bernan

Renouf Publishing Co. Ltd812 Proctor Avenue, Ogdensburg, NY 13669-2205, USATelephone: +1 888 551 7470 Fax: +1 888 551 7471Email: orders@renoufbooks.com Web site: www.renoufbooks.com

Orders for both priced and unpriced publications may be addressed directly to:Marketing and Sales UnitInternational Atomic Energy AgencyVienna International Centre, PO Box 100, 1400 Vienna, AustriaTelephone: +43 1 2600 22529 or 22530 • Fax: +43 1 26007 22529Email: sales.publications@iaea.org • Web site: www.iaea.org/books

ITALYLibreria Scientifica “AEIOU”Via Vincenzo Maria Coronelli 6, 20146 Milan, ITALYTelephone: +39 02 48 95 45 52 Fax: +39 02 48 95 45 48Email: info@libreriaaeiou.eu Web site: www.libreriaaeiou.eu

JAPANMaruzen-Yushodo Co., Ltd10-10 Yotsuyasakamachi, Shinjuku-ku, Tokyo 160-0002, JAPANTelephone: +81 3 4335 9312 Fax: +81 3 4335 9364Email: bookimport@maruzen.co.jp Web site: www.maruzen.co.jp

RUSSIAN FEDERATIONScientific and Engineering Centre for Nuclear and Radiation Safety107140, Moscow, Malaya Krasnoselskaya st. 2/8, bld. 5, RUSSIAN FEDERATIONTelephone: +7 499 264 00 03 Fax: +7 499 264 28 59Email: secnrs@secnrs.ru Web site: www.secnrs.ru

UNITED STATES OF AMERICABernan / Rowman & Littlefield15200 NBN Way, Blue Ridge Summit, PA 17214, USATel: +1 800 462 6420 • Fax: +1 800 338 4550Email: orders@rowman.com Web site: www.rowman.com/bernan

Renouf Publishing Co. Ltd812 Proctor Avenue, Ogdensburg, NY 13669-2205, USATelephone: +1 888 551 7470 Fax: +1 888 551 7471Email: orders@renoufbooks.com Web site: www.renoufbooks.com

Orders for both priced and unpriced publications may be addressed directly to:Marketing and Sales UnitInternational Atomic Energy AgencyVienna International Centre, PO Box 100, 1400 Vienna, AustriaTelephone: +43 1 2600 22529 or 22530 • Fax: +43 1 26007 22529Email: sales.publications@iaea.org • Web site: www.iaea.org/books

18-0

0091

RELATED PUBLICATIONS

www.iaea.org/books

USE OF NUCLEAR MATERIAL ACCOUNTING AND CONTROL FOR NUCLEAR SECURITY PURPOSES AT FACILITIESIAEA Nuclear Security Series No. 25-GSTI/PUB/1685 (63 pp.; 2015)ISBN 978-92-0-101915-8 Price: €30.00

PREVENTIVE AND PROTECTIVE MEASURES AGAINST INSIDER THREATSIAEA Nuclear Security Series No. 8STI/PUB/1359 (25 pp.; 2008)ISBN 978-92-0-109908-2 Price: €20.00

OBJECTIVE AND ESSENTIAL ELEMENTS OF A STATE’S NUCLEAR SECURITY REGIMEIAEA Nuclear Security Series No. 20STI/PUB/1590 (15 pp.; 2013)ISBN 978-92-0-137810-1 Price: €20.00

SECURITY OF NUCLEAR MATERIAL IN TRANSPORTIAEA Nuclear Security Series No. 26-GSTI/PUB/1686 (104 pp.; 2015)ISBN 978-92-0-102015-4 Price: €48.00

NUCLEAR MATERIAL ACCOUNTING HANDBOOKIAEA Services Series No. 15IAEA-SVS-15 (73 pp.; 2008)

NUCLEAR SECURITY RECOMMENDATIONS ON PHYSICAL PROTECTION OF NUCLEAR MATERIAL AND NUCLEAR FACILITIES (INFCIRC/225/REVISION 5)IAEA Nuclear Security Series No. 13STI/PUB/1481 (57 pp.; 2011)ISBN 978-92-0-111110-4 Price: €28.00

NUCLEAR SECURITY CULTUREIAEA Nuclear Security Series No. 7STI/PUB/1347 (37 pp.; 2008)ISBN 978-92-0-107808-7 Price: €30.00

SECURITY OF NUCLEAR INFORMATIONIAEA Nuclear Security Series No. 23-GSTI/PUB/1677 (54 pp.; 2015)ISBN 978-92-0-110614-8 Price: €30.00

Atoms for Peace

Atoms for Peace

INTERNATIONAL ATOMIC ENERGY AGENCYVIENNA

ISBN 978–92–0–103017–7ISSN 1816–9317

Control of nuclear material comprises the administrative and technical measures applied to ensure that nuclear material is not misused or removed from its assigned location without approval and proper accounting. The main purpose of nuclear material control measures is to maintain continuity of knowledge of the nuclear material for the purpose of detecting any actions that could lead to its unauthorized removal or misuse, particularly with respect to insiders. This publication offers technical guidance on the control of nuclear material during production, processing, use, storage and on-site movement at a facility.